identity collector - gateway can't see user/machine details

[Jonathan]

Hi,

Just installed and configured Identity Collector for one of our two domains.

Everything looks fine on the IDC, I can see events and users-machines correlations.

however when running pdp m ip x.x.x.x there are many details missing:

Also in SmartConsole logs I see this:

Anyone familiar with this issue?

[the_rock]

There was a recent post on similar and issue was windows firewall on IC itself, but dont believe thats problem here. Make sure below is checked as per my screenshot.

Andy

 

[Jonathan]

Hi,

There's no firewall on the IDC.

However, "Ignore machine identities" was not checked.

Sounds like it really should not be checked or else it would ignore the machine identity.

Also, how is this related to users not being propagated?

can you explain please?

[Jonathan]

Anyway, I tried what you suggested and it didn't work.

Only now, I don't see machine details at all:

[the_rock]

Sorry man, my bad, I confused 2 different things. I was thinking of "log out", rather than "log in" events. For what you are after, yes, option should be unchecked, apologies. 

I found below links about it, but not sure either one applies 100% to your scenario:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://community.checkpoint.com/t5/Security-Management/Identity-Awareness-We-are-detecting-error-qu...

Let me check on my end and see what could be missing.

[Jonathan]

No problem 🙂

Already went through these links, they didn't help unfortunately...

[PhoneBoy]

Have you done any troubleshooting on the LDAP piece of this?
The groups come from an LDAP lookup from the gateway, not from Identity Collector.

[Jonathan]

The LDAP object is working fine when adquery is used. It's only when switching to IDC that it's not working.

After switching to IDC I unchecked the "AD query" option in the LDAP object, that's the only change I've made.

I rechecked the server and credentials in the LDAP and they're OK. What else can I check?

[the_rock]

That made me remember...when you say unchecked "ad query", are you referring to actual setting on the identity awareness tab on the firewall object itself?

[Jonathan]

Both. 

I've tried all combinations:

IDC + ADQuery on fiewall object

IDC without ADQuery on firewall object

IDC without ADQuery on fiewall object and on LDAP object.

[the_rock]

So odd...I work with customer who has AD query enabled WITH IC as well and no issues at all. Mind you, I believe TAC recommends to turn off AD query if you use IC (which makes sense), but either way, it should work, 100%. Do you see any logs related to this on your AD server at all?

Below is what TAC gave me once to debug identity awareness issue, so this also might be worth a shot.

(•)•) Identity awareness debugs
# cd $FWDIR/log
# rm pdpd.elg.*
# echo "=debug_start=" >> $FWDIR/log/pdpd.elg
(•) To turn pdp debug on:
# adlog a d on
# pdp debug on
# pep debug on
# pdp debug set all all
(•) Replicate the issue
(•) To turn them off:
# adlog a d off
# pdp debug unset all all
# pdp debug off
# pep debug off
# pdp d reset
# pep d unset all all
Collect debug:
$FWDIR/log/pdpd.elg
# tar zcvf pdpd_debugs.tgz pdpd.elg*
# tar zcvf pepd_debugs.tgz pepd.elg*

[maad-pul]

Hi Jonathan,

Did you get this working?

Regards

[chethan_m]

Is this issue resolved? if yes, can you share the solution here, please?

[maad-pul]

Hi! 

I had this issue. I just installed and configured the Identity Collector and missed the LDAP part.
You need to have a "LDAP Account Unit" to map usernames from Identity Collector to the Domain for the Microsoft_AD.

Regards

[chethan_m]

I do have LDAP account unit in place. For me the issue is slightly different. 

The individual user authentication works fine but when I use LDAP user groups instead of individual users in Access Roles the network access doesn't work.

When I do "pdp monitor all" I can users populated and but not their associated user groups on AD.