Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Jonathan
Collaborator

identity collector - gateway can't see user/machine details

Hi,

Just installed and configured Identity Collector for one of our two domains.

Everything looks fine on the IDC, I can see events and users-machines correlations.

however when running pdp m ip x.x.x.x there are many details missing:

1.JPG

Also in SmartConsole logs I see this:

2.JPG

Anyone familiar with this issue?

0 Kudos
14 Replies
the_rock
Legend
Legend

There was a recent post on similar and issue was windows firewall on IC itself, but dont believe thats problem here. Make sure below is checked as per my screenshot.

Andy

Screenshot_1.png

0 Kudos
Jonathan
Collaborator

Hi,

There's no firewall on the IDC.

However, "Ignore machine identities" was not checked.

Sounds like it really should not be checked or else it would ignore the machine identity.

Also, how is this related to users not being propagated?

can you explain please?

 

0 Kudos
Jonathan
Collaborator

Anyway, I tried what you suggested and it didn't work.

Only now, I don't see machine details at all:

3.JPG

0 Kudos
the_rock
Legend
Legend

Sorry man, my bad, I confused 2 different things. I was thinking of "log out", rather than "log in" events. For what you are after, yes, option should be unchecked, apologies. 

I found below links about it, but not sure either one applies 100% to your scenario:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://community.checkpoint.com/t5/Security-Management/Identity-Awareness-We-are-detecting-error-qu...

Let me check on my end and see what could be missing.

0 Kudos
Jonathan
Collaborator

No problem 🙂

Already went through these links, they didn't help unfortunately...

 

0 Kudos
PhoneBoy
Admin
Admin

Have you done any troubleshooting on the LDAP piece of this?
The groups come from an LDAP lookup from the gateway, not from Identity Collector.

Jonathan
Collaborator

The LDAP object is working fine when adquery is used. It's only when switching to IDC that it's not working.

After switching to IDC I unchecked the "AD query" option in the LDAP object, that's the only change I've made.

I rechecked the server and credentials in the LDAP and they're OK. What else can I check?

 

0 Kudos
the_rock
Legend
Legend

That made me remember...when you say unchecked "ad query", are you referring to actual setting on the identity awareness tab on the firewall object itself?

0 Kudos
Jonathan
Collaborator

Both. 

I've tried all combinations:

IDC + ADQuery on fiewall object

IDC without ADQuery on firewall object

IDC without ADQuery on fiewall object and on LDAP object.

 

0 Kudos
the_rock
Legend
Legend

So odd...I work with customer who has AD query enabled WITH IC as well and no issues at all. Mind you, I believe TAC recommends to turn off AD query if you use IC (which makes sense), but either way, it should work, 100%. Do you see any logs related to this on your AD server at all?

Below is what TAC gave me once to debug identity awareness issue, so this also might be worth a shot.

(•)•) Identity awareness debugs
# cd $FWDIR/log
# rm pdpd.elg.*
# echo "=debug_start=" >> $FWDIR/log/pdpd.elg
(•) To turn pdp debug on:
# adlog a d on
# pdp debug on
# pep debug on
# pdp debug set all all
(•) Replicate the issue
(•) To turn them off:
# adlog a d off
# pdp debug unset all all
# pdp debug off
# pep debug off
# pdp d reset
# pep d unset all all
Collect debug:
$FWDIR/log/pdpd.elg
# tar zcvf pdpd_debugs.tgz pdpd.elg*
# tar zcvf pepd_debugs.tgz pepd.elg*

0 Kudos
maad-pul
Contributor

Hi Jonathan,

Did you get this working?

 

Regards

0 Kudos
chethan_m
Collaborator

Is this issue resolved? if yes, can you share the solution here, please?

0 Kudos
maad-pul
Contributor

Hi! 

I had this issue. I just installed and configured the Identity Collector and missed the LDAP part.
You need to have a "LDAP Account Unit" to map usernames from Identity Collector to the Domain for the Microsoft_AD.

Regards

0 Kudos
chethan_m
Collaborator

I do have LDAP account unit in place. For me the issue is slightly different. 

The individual user authentication works fine but when I use LDAP user groups instead of individual users in Access Roles the network access doesn't work.

When I do "pdp monitor all" I can users populated and but not their associated user groups on AD.

 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events