AnsweredAssumed Answered

Identity Collector Setup

Question asked by Jonathan Langley on Dec 6, 2018
Latest reply on Feb 8, 2019 by Dameon Welch-Abernathy

Like • Show 2 Likes2
Comment • 8

I am trying to experiement with the Identity Collector for IA. I have Identity Collector installed on Windows Server with our DCs and it has made a success SIC connection to one of our Gateways WIth Browser-Based Auth and Identity Collector Selected for its Sources. whenever I go to create an Access Role for my test user, I do not see my Identity Collector as a source under Specific users/Groups area, only the LDAP Account units from our AD Query set up. Am I missing something or doing something wrong here?

No one else has this question

Outcomes

8 Replies

Dameon Welch-Abernathy Dec 7, 2018 1:04 PM
Mark Correct
Correct Answer
That's expected behavior.
Identity Collector is used to acquire users from Active Directory to the Security Gateways.
The groups those users are associated with are queried via LDAP.
Access Roles are also defined in terms of LDAP groups.
Like • Show 0 Likes0
Actions
- Jonathan Langley @ Dameon Welch-Abernathy on Dec 10, 2018 6:17 AM
  Mark Correct
  Correct Answer
  So how would i create a security rule to allow access to a specific site to a use with identity collector? I guess that is where I am lost.
  Like • Show 0 Likes0
  Actions
  - Ole Jakobsen @ Jonathan Langley on Jan 17, 2019 11:54 PM
    Mark Correct
    Correct Answer
    I have the same exact problem.
    
    My collector collects events and logins from AD. I have gateways setup with Identity Collector access and they are connected.
    
    In my GUI for Identity Collector, I can check that it looks logins in the "Logins Monitor" pane, and I see that it is connected and sends event to gateways in the "Gateways" panel.
    
    My configuration is done according to the instructions "CP_R80.20_IdentityAwareness_AdminGuide.pdf".
    
    But at the gate I can't see the identities when I try to create a new access role.
    
    Also, in the logs in the gateway I see only "Error log" and "User Logout" events.
    
    What am I missing? Where will the identity be created in the identity?
    
    I hope someone can help clarify this I can't finde any sk that does that.
    
    Cheers
    Ole
    Like • Show 0 Likes0
    Actions
    - Dameon Welch-Abernathy @ Ole Jakobsen on Jan 18, 2019 6:48 AM
      Mark Correct
      Correct Answer
      Access Roles are defined in terms of LDAP Groups, not individual users.
      The only pace you will see individual users is in the logs.
      If you're not seeing any LDAP Groups when you create an Access Role, it suggests you have either not configured LDAP Account Units or there is a misconfiguration.
      2 people found this helpful
      Like • Show 1 Like1
      Actions
      - Ole Jakobsen @ Dameon Welch-Abernathy on Jan 28, 2019 12:06 AM
        Mark Correct
        Correct Answer
        So just to clarify, for myself, Identity Collector is used populate LDAP groups retrieved from LDAP/AD via Account Units. Correct?
        Like • Show 0 Likes0
        Actions
        Timothy Hall @ Ole Jakobsen on Jan 28, 2019 5:01 AM
        Mark Correct
        Correct Answer
        No, the IC parses the domain security log entries and forms mappings for LAN IP addresses to a username, and sends that information to the gateway who places it into its IA cache. Upon receipt of the new mapping, the gateway itself directly queries AD to retrieve the mapped user's group memberships and keeps them up to date. If you want to look directly in the gateways IA cache for troubleshooting purposes, please see my response in this thread:
        
        https://community.checkpoint.com/message/38332-re-app-control-ignoring-a-rule?commentID=38332#comment-38332
        
        --
        CheckMates Break Out Sessions Speaker
        CPX 2019 Las Vegas & Vienna - Tuesday@13:30
        1 person found this helpful
        Like • Show 1 Like1
        Actions
        Ole Jakobsen @ Timothy Hall on Feb 7, 2019 3:31 AM
        Mark Correct
        Correct Answer
        Thanks for your answer Timothy. That clarifies some things for me
        
        Is it the same thing with IC and Cisco ISE?
        
        If IC retrieves User/IP mapping from Cisco ISE and sends them to the GW to be stored in the IA cache. Do the GW then query ISE for "SGT" membership or is the membership included in the information from ISE and the populated to the "Identity Tag" that is manually created according to Identity Awareness Admin Guide as CSGT-<SGT_NAME>?
        Like • Show 0 Likes0
        Actions
        Dameon Welch-Abernathy @ Ole Jakobsen on Feb 8, 2019 2:08 PM
        Mark Correct
        Correct Answer
        It still works the same way, more or less:
        Identity comes from Cisco ISE in the form of name, machine, and IP
        Groups come from LDAP
        With Cisco ISE, there is an additional mechanism that leverages the CSGT-<Name> tags via the
        CloudGuard Controller: CloudGuard Controller R80.20 Administration Guide
        You can create rules based on these tags once they are defined.
        Like • Show 0 Likes0
        Actions

Identity Collector Setup

Outcomes

Related Content

Recommended Content