Identity Collector - Configuring as Identity Source

Limitation

When you use a centralized Infinity Identity Provider, do not select a specific Identity Provider object object in the Authentication Settings > User Directories section. Select All Gateway's Directories instead. If you select a specific Identity Provider object, the SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. GUI allows the selection and the policy installation succeeds. However, Identity Collector Check Point dedicated client agent installed on Windows Servers in your network. Identity Collector collects information about identities and their associated IP addresses and sends it to the Check Point Firewalls for identity enforcement, you can download the Identity Collector package from the Support Center. authentication fails.

Configuring the Identity Collector Settings on the Identity Awareness Gateway

To enable the Identity Collector solution, you must configure it in the Identity Awareness Software Blade on a Check Point Firewall that enforces network access and audits data based on network location, the identity of the user, and the identity of the computer. Acronym: IDA. Gateway object in SmartConsole:

Open SmartConsole and from the left panel, click Gateways & Servers.
Open the Identity Awareness Gateway object.
From the left menu, click the Identity Awareness pane.
Select Identity Collector and click Settings.

In the Identity Collector Settings window, configure these:

Client Access Permissions

Select to which interfaces on the Identity Awareness Gateway the Identity Collector can connect.

Available options are based on the topology configured for the Identity Awareness Gateway interfaces:

Through all interfaces

Identity Clients can connect to the Identity Awareness Gateway through all interfaces that an administrator configured in the Identity Awareness Gateway object (regardless of their Topology settings).
Through internal interfaces

Identity Clients can connect to the Identity Awareness Gateway through internal interfaces only.
- Including undefined internal interfaces
  
  Identity Clients can connect to the Identity Awareness Gateway through all interfaces that the administrator configured in this way in the Identity Awareness Gateway object:
  1. From the left tree, click Network Management.
  2. Right-click an interface and click Edit.
  3. In the Topology section, click Modify.
  4. In the Leads To section, select Override > select This Network (Internal) > select Not defined.
  5. Click OK.
- Including DMZ internal interfaces
  
  Identity Clients can connect to the Identity Awareness Gateway through interfaces that the administrator configured in this way in the Identity Awareness Gateway object:
  1. From the left tree, click Network Management.
  2. Right-click an interface and click Edit.
  3. In the Topology section, click Modify.
  4. In the Leads To section, select Override > select the applicable option > select Interface leads to DMZ.
  5. Click OK.
- Including VPN encrypted interfaces
  
  Identity Clients can connect to the Identity Awareness Gateway through interfaces used for establishing route-based VPN tunnels (VTIs).
According to the Firewall policy

Select this option to control the access with Access Control rules.

Important - The Through all interfaces and Through internal interfaces options have priority over Access Control Policy rules. If an Access Control rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. is configured to block connections from Identity Collector clients, the Identity Awareness Gateway continues to allow these connections.

Authorized Clients

An Identity Awareness Gateway accepts connections only from authorized Identity Collector client computers.

To configure authorized Identity Collector client computers:

In the Authorized Clients section of the Identity Collector Settings window, click the green [+] icon and select an Identity Collector client from the list.

Notes:

To create a specified new host object:
1. Close the Identity Collector Settings window.
2. Close the Identity Awareness Gateway Properties window.
3. From the top toolbar, click the Objects menu > More > Network Object > New Host.
  
  Or from the right upper corner, click the Objects tab > New > Host.
To remove a current Identity Collector client from the list, select the client and click the red [-] icon.

To create an authentication secret for a selected Identity Collector client:

Select the Identity Collector client in the list.
Click Generate, or enter the applicable secret manually.

Notes:

Each client has its own client secret.
To change a client secret, change it manually.

Authentication Settings

The Identity Awareness Gateway separately saves the authentication settings for different Identity Clients. This lets the administrator configure different authentication settings for different Identity Clients.

In the Authentication Settings section, click Settings.

The User Directories window opens.
Configure where the Identity Awareness Gateway can search for users when they try to authenticate:
- Internal users - The directory of configured internal users.
- Users from external directories:
  - All Gateway's Directories - All external directories from which the Identity Awareness Gateway pulls identities..
  - Specific - Users from one or more external directories. To add an external directory, click the + button. In the window that opens, search for and select the external directory and click OK.
- External user profiles - The directory of users, who have external user profiles.
By default, all User Directories options are selected. You can select only one or two options, if users are only from a specified directory, and you want to maximize Security Gateway performance, when users authenticate. Users with identical user names must log in with domain\username.
Click OK to close the User Directories window.

Click OK to close the Identity Collector Settings window.
Click OK to close the Check Point Gateway window.
Optional: To enforce the Cisco Security Group Tags (SGTs) on the Identity Awareness Gateway:
1. In SmartConsole, click the Objects menu > click Object Explorer.
2. In the Object Explorer, click New > User > User Group.
3. Name the new group: CSGT-<SGT_NAME>.
4. Assign this group to an Access Role Access Role objects let you configure network access according to: Networks, Users and user groups, Computers and computer groups, Remote Access Clients. After you activate the Identity Awareness Software Blade, you can create Access Role objects and use them in the Source and Destination columns of Access Control Policy rules..
Install the Access Control Policy.