Identity Sharing is active on the PEP when not configured

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk129392
Technical Level
Product	Identity Awareness
Version	R75 (EOL), R76 (EOL), R77 (EOL), R80.10 (EOL)
OS	Gaia
Date Created	22-Jul-2018
Last Modified	13-May-2019

Symptoms

Enforcement issues on specific networks / missing identities on enforcement points (PEP).
The PEP Security Gateway opens a connection to other Security Gateways which are not configured to share identities with it.
The user can verify this by running the following command on the PEP:
Example of output:
Look for connections established by local pepd on port 28581 to remote Security Gateway (PDP) which is NOT sharing identities to this PEP Security Gateway.
Running the following command and looking for remote Security Gateway (PDP) shows that it is NOT sharing identities to this PEP Security Gateway.
Output example:

Cause

In some scenarios, the PEP Gateway connects to remote Gateway PDPs not according to the Identity Sharing configuration. For example, even though sharing is not enabled on the PEP, or the PEP is not configured to fetch from a specific PDP, a connection is nevertheless made.

This will cause the PEP to try to fetch identities and perform network registrations which could lead to enforcement issues on those networks.

Solution

Note: To view this solution you need to Sign In .