Identity Sharing

An Identity Awareness Security Gateway configured as a Policy Decision Point gets identity information and shares it with other Identity Awareness Security Gateways configured as Policy Enforcement Points. This way, only one Identity Awareness Security Gateway performs the group membership query and calculates the Access Role object. This reduces the load on the identity sources on User Directory Check Point Software Blade on a Management Server that integrates LDAP and other external user management servers with Check Point products and security solutions., or on both.

PDP - Policy Decision Point:

• Gets user/machine identities from the designated identity sources.

• Shares user/machine identities with other Identity Awareness Security Gateways.

PEP - Policy Enforcement Point:

• Provides the applicable Access Roles to the Rule Base All rules configured in a given Security Policy. Synonym: Rulebase. matching process. It enforces the procedure as defined in the policy.

• Can receive identities through Identity Sharing.

• Can redirect users to the Identity Awareness Captive Portal.

Supported Configurations for Identity Sharing:

• One PDP Check Point Identity Awareness Security Gateway that acts as Policy Decision Point: acquires identities from identity sources; shares identities with other gateways. shares identities to multiple PEPs.

• One PEP Check Point Identity Awareness Security Gateway that acts as Policy Enforcement Point: receives identities via identity sharing; redirects users to Captive Portal. receives identities from multiple PDPs.

• PDP and PEP processes run on different Security Gateways and use a Smart-Pull Sharing method for the connection.

• PDP and PEP processes run on the same Security Gateway and use a Push Sharing method for the connection.

To configure Identity Sharing, you must do these steps in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on.:

1. Configure Identity Awareness Security Gateways that share identities (Policy Decision Points):

   1. From the left navigation panel, click Gateways & Servers.

   2. Open the applicable Security Gateway object.

   3. From the left tree, click Identity Awareness > Identity Sharing.

   4. Click Share local identities with other gateways.

   5. Click OK.

2. Configure Identity Awareness Security Gateways that receive identities (Policy Enforcement Points):

   1. Open the applicable Security Gateway object.

   2. From the left tree, click Identity Awareness > Identity Sharing.

   3. Click Get identities from other gateways.

   4. Select the applicable PDP Security Gateway from the list.

      Note - Only Security Gateways that have the "Share local identities with other gateways" option selected appear on the list.

   5. Click OK.

3. Install the Access Control policy on all these Security Gateways.

In large environments, not all PEPs require the identities from all PDPs. For example, small branch offices with a small number of users do not need to store all of the identities from the PDP in the headquarters office.

When the Smart Pull method is configured, identities are sent to the PEP only when the PEP requests or pulls them from the PDP. This saves space on the PEP and avoids unnecessary transactions between the PDP and the PEP on the network.

The Smart-Pull Identity Sharing operation stages are:

1. Identity Acquisition

   • The PDP gets identities and keeps them in the PDP repository.

   • The PDP notifies the applicable PEPs about the network (Class C), where the user was identified.

   Notes: The PDP does not publish the identities to the PEPs yet. You can run the "pep show network pdp" command on the PEP to show the PDPs and the networks they identify. You can run the "pdp network info" command on the PDP to show all the networks it publishes.

2. Sub-Network Registration

   A user initiates a connection through the PEP. If the policy requires an identity element, the PEP searches for the identity in its local database.

   • If the identity is not found, the PEP searches for a PDP that knows the applicable Class C network to resolve the identity.

   • If the identity is found, then:

     1. The PEP registers to the PDP for notification about a smaller network (subnet mask 255.255.255.240).

     2. The PDP publishes all the currently known identities from the networks with the subnet mask 255.255.255.240 to the registering PEPs.

   Notes: You can run the "pep show network registration" command on the PEP to show the networks with the subnet mask 255.255.255.240, to which the PEP is registered. You can run the "pdp network registered" command on the PDP to show the list of the PEPs for the networks with the subnet mask 255.255.255.240.

3. Identity Propagation

   1. The PDP gets identity of a user, who has an IP address from an already registered network with the subnet mask 255.255.255.240.

   2. The PDP immediately publishes the identity to the registered PEPs.

In this method, when a PDP gets an identity, the PDP publishes the identity to the PEP.

Note - This is the only supported sharing method for an Identity Awareness Security Gateway that performs PDP and PEP roles.

With Identity Sharing, there is always a connection from PDP to PEP, shown below as Outgoing.

Outgoing (2) is the local connection PDP -> PEP that run on the same Security Gateway.

With the Smart-Pull sharing method, when PDP and remote PEP use Identity Sharing, there is another connection PEP->PDP shown below as Incoming (1).

For more information, see Deployment Scenarios.