Identity Agent for a User Endpoint Computer - Server Discovery and Server Trust

Discovery and Trust Options

These are the configuration options for the client to discover and trust a server:

General Overview

Server Discovery Based on an Identity Agent File Name

This option is the easiest to configure, and works by default if Captive Portal is configured in addition the Identity Awareness Gateway. This configuration is suitable for an environment that meets these criteria:

• There is one Identity Awareness Gateway.

• Captive Portal and Identity Awareness run on the same Security Gateway

• It is acceptable for new users to verify the server fingerprint once to establish trust.

How does it work?

When a user downloads the Identity Agent client from the Captive Portal, the address of the Identity Awareness Gateway is added to the file name. During the installation sequence, the client checks if there is any other discovery method configured (Pre-packaged, AD-based, DNS-based or local registry). If no discovery method is configured, the Identity Agent connects to the Identity Awareness Gateway.

Why cannot we use this for data trust?

As the file name can be changed, we cannot be sure that the file name was not modified by an attacker along the way. Therefore, we cannot trust data passed in the file name as authentic, and we need to verify the trust data by another means.

Server Discovery Based on Active Directory Membership

If endpoint computers are members of an Active Directory domain, and you have administrative access to this domain, you can use the Identity Agent Distributed Configuration Tool to configure connectivity and trust rules for Identity Agent. This tool is installed a part of the Identity Agent.

The Identity Agent Distributed Configuration Tool has three panes:

• Welcome - This pane describes the tool and lets you enter alternate credentials that you use to get an access to the AD.

• Server Configuration - This pane lets you configure, to which Identity Awareness Gateway the Identity Agent should connect, depending on the IPv4 / IPv6 address that is configured on the endpoint computer, or its AD Site.

• Trusted Gateways - This pane lets you view and change the list of fingerprints of Identity Awareness Gateways, which the Identity Agent considers secure.

Server Configuration Rules

The Identity Agent fetches the configured rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. lists from the Active Directory database. When the Identity Agent connects to an Identity Awareness Gateway, it matches against the rules, from top to bottom.

When the Identity Agent matches a rule, it uses the Identity Awareness Gateways configured in this rule based on the specified priority.

For example:

This configuration means:

• If the user's computer is configured with the IPv4 address 192.168.0.1 / 24, then the Identity Agent needs to connect to the Identity Awareness Gateway "US-GW1".

  If the gateway "US-GW1" is not available, then the Identity Agent needs to connect to the Identity Awareness Gateway "BAK-GS2" (applies only if gateway "US-GW1" is not available, because its priority is higher). 

• If the user connects from the Active Directory site "UK-SITE", then the Identity Agent needs to connect to Identity Awareness Gateway "US-GW1", or to Identity Awareness Gateway "UK-GW2". The Identity Agent selects between these gateways randomly, because they both have the same priority).

  If both of these gateways are not available, then the Identity Agent needs to connect to the Identity Awareness Gateway "BAK-GS2".

• The default rule is that the Identity Agent needs to connect to Identity Awareness Gateway "BAK-GS2" (the default rule is always matched when it is encountered).

Trusted Gateways

The Trusted Gateways pane shows the list of Identity Awareness Security Gateways considered trusted. When the Identity Agent starts to connect to these Identity Awareness Security Gateways, no pop-up windows open.

You can add, edit or delete a server. If you get a connection to the Identity Awareness Security Gateway, enter its address and click Fetch Fingerprint to get the name and fingerprint. If not, enter the same name and fingerprint that appear when you connect to this Identity Awareness Security Gateway.

Server Discovery Based on a DNS SRV Record

If you configure the client to "Automatic Discovery" (the default), it looks for a server by issuing a DNS SRV query for the address "CHECKPOINT_NAC_SERVER._tcp" (the DNS suffix is added automatically). You can configure the address in the DNS server.

On the DNS server (Example is for Windows 2003. For more information, see official Microsoft documentation):

1. Go to Start > All Programs > Administrative Tools > DNS.

2. Go to Forward lookup zones and select the applicable domain.

3. Go to the _tcp subdomain.

4. Right-click and select Other new record.

5. Select Service Location, Create Record.

6. In the Service field, enter CHECKPOINT_NAC_SERVER.

7. Set the Port number to 443.

8. In Host offering this service, enter the address of the Identity Awareness Gateway.

9. Click OK.

Server Discovery Based on Remote Registry

If you have another way to configure registry entries to your client computers (such as Active Directory GPO updates), you can configure the Identity Awareness Gateway addresses and trust parameters before you install the clients. Clients use the new settings immediately after installation.

To use the remote registry option:

1. Install the client on a computer. Make sure it is installed in the same mode in all computers.

   The full Identity Agent installs itself to your Program Files directory and saves its configuration to HKEY_LOCAL_MACHINE.

   The light Identity Agent installs itself to the Users directory and saves its configuration to HKEY_CURRENT_USER.

2. Connect manually to all of the servers that are configured, verify their fingerprints, and click Trust in the fingerprint verification window.

3. In the client Settings window, configure it to connect to the requested servers.

   If you let the client select a server in dependence to location, click Advanced (see Server Discovery Based on Active Directory Membership).

4. Export these registry keys (from HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER, based on the client type installed):

   1. The whole tree:

      SOFTWARE\CheckPoint\IA\TrustedGateway.

   2. The "IA" branch:

      • 32-bit:

        SOFTWARE\CheckPoint\IA\

      • 64-bit:

        SOFTWARE\Wow6432Node\Checkpoint\IA

      Parameters:

      • Default Gateway

      • DefaultGatewayEnabled

      • PredefinedPDPConnRBUsed

      • PredefinedPDPConnectRuleBase

5. Configure the exported keys on the workstations before you install the client on them.