Issue with User Awareness Query on Check Point SMB (Locally Managed)

[rozkie20]

Hi Everyone,

We are currently configuring User Awareness on a Check Point SMB firewall with local management, but we are unable to query users from our Active Directory (AD) server.

We are using a non-administrator account and have modified the group permissions according to sk93938 (Using Identity Awareness AD Query without Active Directory Administrator privileges on Windows Server 2008 and higher).

Troubleshooting Steps Taken:
We confirmed that the Gateway can ping the AD server.

The Gateway can access the AD server on port 389 (verified through firewall logs).

We also tested authentication using an Administrator account to rule out permission issues, but the problem persists.

Has anyone encountered this issue when using local deployment? Any insights would be greatly appreciated.

Thanks for reading!

[G_W_Albrecht]

Can you please specify model and firmware of the SMB ? Where is the AD situated, locally at site ?

[rozkie20]

Hi Albrecht,

We using CP 2000 series with firmware 81.10.15

[G_W_Albrecht]

Where is the AD situated, locally at site ?

[rozkie20]

We using AD server locally site with topo seem like this

 

[G_W_Albrecht]

So the issue seems the internal firewall - did you enable IA there also and set it to Identity Sharing ?

[rozkie20]

I am just test this option on internal firewall but it seem to not working.

[PhoneBoy]

That will only work with gateways managed by the same management, which is not the case here since your SMB gateway is locally managed.
I suspect you'll need a TAC case to understand why you're getting an internal error adding the AD server.

[G_W_Albrecht]

So one solution would be to put SMB GW under same management as internal GW...