Who rated this post

Actually, it looks like there’s some confusion here. Let me clarify:

• PEP (Policy Enforcement Point) = the gateways/firewalls that enforce policies. These are what pdp connections pep shows.
• PDP (Policy Decision Point) = the component that decides policies, usually running on Identity Awareness gateways.
• Identity Broker Cluster = just handles identity distribution between PDPs; it is not enforcing anything.

So in your scenario:

• Gateway A is a PEP → appears in pdp connections pep.
• Cluster B is an Identity Broker → does not appear in pdp connections pep.
• To see connections between PDPs/Brokers, you would run pdp connections b s.

Think of it as: PEPs enforce, Brokers distribute, and pdp connections pep only lists the enforcers.