Identity Collector - Requirements

Supported Identity Sources

The Identity Collector Check Point dedicated client agent installed on Windows Servers in your network. Identity Collector collects information about identities and their associated IP addresses, and sends it to the Check Point Security Gateways for identity enforcement. For more information, see sk108235. You can download the Identity Collector package from sk134312. supports these Identity Sources:

• Microsoft Active Directory Domain Controllers

  (see Identity Collector - Working with Active Directory)

• Cisco Identity Services Engine (ISE) Servers

  (see Identity Collector - Working with a Cisco Identity Services Engine (ISE) Server)

• NetIQ eDirectory Servers (requires Identity Awareness Check Point Software Blade on a Security Gateway that enforces network access and audits data based on network location, the identity of the user, and the identity of the computer. Acronym: IDA. Gateway R80.20 and higher)

  (see Identity Collector - Working with NetIQ eDirectory LDAP Servers)

• Syslog messages (requires Identity Awareness Gateway R80.20 and higher)

  (see Identity Collector - Working with Syslog Messages)

Requirements for the Windows Server

These are minimum requirements for the Windows Server on which Identity Collector is installed:

• Supported versions of Windows Server:

  • Windows Server 2022

  • Windows Server 2019

  • Windows Server 2016

  • Windows Server 2012 R2

  • Windows Server 2012

  • Windows Server 2008 R2

  • Windows Server 2008

• Windows Server must have a minimum of 8 GB of RAM

• Windows Server must have a minimum of 10 GB of free disk space

• Windows Server must have .NET framework (version 4) installed

• An Administrator account is required on the Windows Server to install and to run the Identity Collector.

• Windows Server must connect to the Identity Awareness Gateway over TCP port 443

• If you install Identity Collector directly on the Domain Controllers (DCs) (including Windows Firewall), make sure the Windows Firewall rules allow DNS, LDAP, and DCOM traffic from the computer on which Identity Collector is installed.
  

  In Windows Firewall, add this "Allow" rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session.:

  "Remote Event Log Management" > "Remote Event Log Management (RPC)"

• Identity Collector processes these Windows events:

  • Authentication events - 4624, 4768, 4769, 4770

  • Group update events - 4728, 4729, 4732, 4733, 4756, 4757

  • Group deletion events - 4730, 4734, 4758

Best Practice - For best performance, use a Windows Server with: A minimum of 12 CPU cores A minimum of 16 GB of RAM A minimum of 60 GB of free disk space