GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Identity Awareness

Deleted user User has deleted their subject information English 50 cards

Cards in this deck (50)

  1. 1What does an Access Role object include?Access Role objects can include one or more of these objects:
    • Networks
    • Users and user groups
    • Computers and computer groups
    • Remote Access Clients
  2. 2What are the limitations to be aware of when using AD Query?AD Query limitations:
    • User/IP association timeout - After a predefined period of network inactivity, a user session closes automatically.
    • Many user accounts connected from the same IP address.
    AD Query cannot detect when a
    user logs out. Therefore, more than one user can have open sessions from the same IP address. When this occurs, the permissions for each account remain active until their User/IP association timeout occurs.
  3. 3What methods of identity acquisition does Browser-Based Authentication use?Browser-Based Authentication gets identities and authenticates users with one of these acquisition methods:
    • Captive Portal
    • Transparent Kerberos Authentication
  4. 4What conditions must exist for the captive portal to be shown to the user?The Captive Portal shows when a user tries to access a web resource and all of these conditions apply:
    • Captive Portal is enabled.
    • The redirect option enabled for the applicable rule.
    • Firewall or Application Control and URL Filtering rules block access by unidentified users to resources that would be allowed if they were identified.
  5. 5How Transparent Kerberos Authentication WorksTransparent Kerberos Authentication authenticates users by getting authentication data from the browser without any user input. If authentication is successful, the user goes directly to the specified destination. If authentication fails, the user must enter credentials in the Captive Portal.
    WORKFLOW
    1. A user wants to access the Internal Data Center.
    2. Identity Awareness does not recognize the user and redirects the browser to the Transparent Authentication page.
    3. The Transparent Authentication page asks the browser to authenticate itself.
    4. The browser gets a Kerberos ticket from Active Directory and presents it to the Transparent Authentication page.
    5. The Transparent Authentication page sends the ticket to the Security Gateway, which authenticates the user and redirects it to the originally requested URL.
    6. If Kerberos authentication fails for some reason, Identity Awareness redirects the browser to the Captive Portal.
  6. 6How many types of Endpoint Identity Agents are there?There are three types of Endpoint Identity Agents, Full, Light and Custom:
    • Full – Predefined Endpoint Identity Agent that includes packet tagging and computer authentication. It applies to all users of the computer that it is installed on. Administrator permissions are required to use the Full Endpoint Identity Agent type. For the Full Endpoint Identity Agent you can enforce IP spoofing protection. You can also leverage computer authentication if you define computers in access roles.
    • Light – Predefined Endpoint Identity Agent that does not include packet tagging and computer authentication. You can install this Endpoint Identity Agent individually for each user on the
    target computer. Administrator permissions are not required.
    • Custom - Configure custom features for all computers that use this agent, such as MAD services and packet tagging
  7. 7What does Endpoint Identity Agents provide?Using Endpoint Identity Agents gives you:
    • User identification - Users that log in to the Active Directory domain are transparently authenticated (with SSO) and identified when using an Endpoint Identity Agent. If you do not configure SSO or you disable it, the Endpoint Identity Agent uses username and password authentication with a standard LDAP server.
    • Computer identification - You get computer identification when you use the Full Endpoint Identity Agent as it requires to install a service.
    • Seamless connectivity - Transparent authentication using Kerberos Single Sign-On (SSO) when users are logged in to the domain. Users who do not want to use SSO, enter their credentials manually. You can let them save these credentials.
    • IP change detection - When an endpoint IP address changes (interface roaming or DHCP assigns a new address), the Endpoint Identity Agent automatically detects the change and
    reconnects.
    • Added security - You can use the patented packet tagging technology to prevent IP Spoofing, it requires Full Endpoint
  8. 8What is packet tagging technology?Packet Tagging is a patent pending technology that prevents spoofed connections from passing through the Security Gateway. This is done by a joint effort between the Endpoint Identity Agent and the Security Gateway that uses a unique technology that sign packets with a shared key.
  9. 9What is Terminal Servers Endpoint Identity Agent?Terminal Servers Endpoint Identity Agent - An Endpoint Identity Agent installed on an application server that hosts Citrix/Terminal services. The Identity Awareness Terminal Servers solution lets
    the system enforce identity awareness policies on multiple users that connect from one IP address. The Terminal Servers solution is based on reserving a set of TCP/UDP ports for each user. Each
    user that is actively connected to the application server that hosts the Terminal/Citrix services is
    dynamically assigned a set of port ranges. The gateway receives that information. Then, when a user attempts to access a resource, the packet is examined and the port information is mapped to the user.
  10. 10Which Blades is Remote Access Identities applied to?Remote Access Identities are acquired for Mobile Access clients and IPSec VPN clients configured to work in
    Office Mode when they connect to the Security Gateway. This option is enabled by default.
  11. 11Que orígenes de identidad soporta Identity Collector?The Identity Collector supports these Identity Sources:
    • Microsoft Active Directory Domain Controllers
    • Cisco Identity Services Engine (ISE) Servers, versions 2.0, 2.1 and 2.2
  12. 12How do you group identity sources when you use Identity Collector?The Identity Collector can connect with more than one Identity Source at a time.
    The Identity Sources are organized in Query Pools. A Query Pool is an object which contains a number of Identity Sources. Each Query pool is assigned to one gateway. The Identity Collector collects information from the Identity Sources in the Query Pools and sends the information to the gateways.
  13. 13What protocol does the Identity Awareness API work on?The web API uses the REST protocol over HTTPS. The Security Gateway authenticates and authorizes the users and computers with the information it gets from the web API.
  14. 14What are the three commands supported in the Identity Awareness API?Identity Awareness web API gets JSON requests over HTTPS, and each HTTP request contains one Identity Awareness web API command or a bulk of commands. Each API command must include a shared secret pre-configured in SmartConsole.
    The Identity Awareness web API supports 3 commands:
    • add-identity
    • delete-identity
    • show-identity
  15. 15Endpoint Identity Agent is recommended for:• Identity enforcement for Data Centers
    • Protecting highly sensitive servers
    • When accuracy in detecting identity is crucial
  16. 16can Identity Awareness be deployed in Bridge mode?Yes, Identity Awareness can be deployed in Bridge mode or Route mode.
  17. 17What modes of ClusterXL does identity awareness support?Identity awareness supports ClusterXL HA and LS modes.
  18. 18Identity awareness and LDAP ports?LDAP 389
    LDAP over SSL 636
    AD Query 135
    Global Catalog 3268
    Global Catalog over SSL 3269
    Gateway to AD 135, 389
    AD to gateway 135
    Enforcement gateway 389
    Identity Sharing gateway to Enforcement gateway 15105, 28581
    Browser-based Authentication 443
    Identity Agents/Terminal Server Agents 443
    Radius Accounting 1813
  19. 19What are the effects of applying Single User Assumption?Single User Assumption
    You can configure AD Query to allow only one active account per IP address. When user A logs out before the timeout and user B logs in, the user A session closes automatically and his permissions are canceled. User B is the only active user account and only his permissions are valid. Before you activate Single User Assumption, you must exclude all service accounts used by user computers
  20. 20If the automatic exclusion of service accoutns is enabled in Single User Assumption, what does identity awareness take into account to effectively exclude an account in the AD Query?You can manually exclude service accounts, users, computers and networks from the AD Query
    scan. You can also configure AD Query to automatically detect and exclude suspected service accounts. Identity Awareness identifies service accounts as user accounts that are logged in to
    more than a specified number of computers at the same time.
    Suspected Service Account List
    When automatic exclusion is enabled, Identity Awareness looks for suspected service accounts every 10 minutes. Suspected service accounts are saved to a persistent database that survives
    reboot.
  21. 21Use these commands to see and manage the suspected service account database:-To show all suspected service accounts, run: adlog a control srv_accounts show
    -To run the service accounts scan immediately, run: adlog a control srv_accounts find. This command is useful before you enable the Assume that only one user is connected option.
    -To remove an account from the service account database, run: adlog a control
    srv_accounts unmark
    -To remove all accounts from the suspected service account database, run: adlog a control srv_accounts clear
  22. 22sure that the domain controllers are set properly by using the ____ CLIChecking the Status of Domain Controllers. You can make sure that the domain controllers are set properly by using the adlog CLI. You can
    see the domain controllers that the Security Gateway is set to communicate with as well as the domain controllers it ignores.
    The CLI command is: adlog a dc
  23. 23What is the default priority of an LDAP server if you want to exclude this server from AD queries?For each domain controller that is to be ignored, the default priority of the Account Unit must be set to a value higher than 1000.
    When all of the domain controllers belong to the same Active Directory, one LDAP Account Unit is created in SmartConsole. When AD Query is enabled on Security Gateways, you may want to configure each Security Gateway to communicate with only some of the domain controllers.
  24. 24What interface options do you have to enable access to the captive portal through Browser-Based Authentication?Browser-Based Authentication -> Access Settings -> Accessibility
    Users are sent to the Captive Portal if they use networks connected to these interfaces.
    • Through all interfaces
    • Through internal interfaces
     Including undefined internal interfaces
     Including DMZ internal interfaces
     Including VPN encrypted interfaces
    • According to the Firewall policy - Select this if there is a rule that states who can access the portal.
  25. 25What option does SSO enable through Kerberos in Browser-Based Authentication?COMPROBAR RUTA
    Gateway -> Identity Awareness -> Browser-Based Authentication ->
    Browser transparent Single Sign-On -> "Select Automatically authenticate users from computers in the domain" if Transparent Kerberos Authentication is used to identify users.
    • Main URL: The URL used to begin the SSO process. If transparent authentication fails, users are redirected to the configured Captive Portal URL.
  26. 26In Browser-Based Authentication what are the authentication options and user directory?Browser-Based Authentication method:
    • Defined on user record (Legacy Authentication) - Takes the authentication method from Gateway Object Properties > Other > Legacy Authentication.
    • User name and password - This can be configured internally or on an LDAP server.
    • RADIUS - A configured RADIUS server. Select the server from the list.
    Browser-Based Authentication User Directories. User Directoris are one or more places where the Security Gateway searches to find users when they try to authenticate. The options are:
    • Internal users - The directory of internal users.
    • LDAP users - The directory of LDAP users. Either:
     Any - Users from all LDAP servers.
     Specific - Users from an LDAP server that you select.
    • External user profiles - The directory of users who have external user profiles.
  27. 27Is it possible to create an access role object to allow unidentified users?5. Create an Access Role rule in the Rule Base, to let identified users access the Internet from the organization:
    a) Right-click Source and select Access Role.
    b) In the Users tab, select All identified users.
    6. Create an Access Role rule in the Rule Base, to let Unauthorized Guests access only the Internet:
    a) Right-click Source and select Access Role.
    b) In the Users tab, select Specific users > Unauthenticated Guests.
  28. 28When you enable Identity Awareness on a Log Server, you add user and computer identification to Check Point ___When you enable Identity Awareness on a Log Server, you add user and computer identification to Check Point logs.
    The Log Server communicates with Active Directory servers. The Log Server stores the data extracted from the AD in an association map. When Security Gateways generate a Check Point log entry and send it to the Log Server, the server gets the user and computer name from the association map entry that corresponds to the source IP address of the event log. It then adds this identity aware information to the log.
  29. 29If you have configured Identity Awareness for a log server, but do not see identities in logs, make sure you installed the ______If you have configured Identity Awareness for a log server, but do not see identities in logs, make sure you installed the database.
    To install the database
  30. 30What is Identity Sharing?In environments that use many Security Gateways and AD Query, we recommend that you set only one Security Gateway to acquire identities from a given Active Directory domain controller for each physical site. If more than one Security Gateway gets identities from the same AD server, the AD server can become overloaded with WMI queries. Set these options on the Identity Awareness > Identity Sharing page of the Security Gateway object:
    • One Security Gateway to share identities with other Security Gateways. This is the Security Gateway that gets identities from a given domain controller.
    • All other Security Gateways to get identities from the Security Gateway that acquires identities from the given domain controller.
  31. 31You _____ add domain controllers from two different subdomains into the same account unit.To configure Identity Awareness for a Domain Forest (Subdomains), create a separate LDAP Account Unit for each domain in the forest (subdomain). You cannot add domain controllers from two different subdomains into the same account unit.
  32. 32When you create an LDAP Account Unit for each domain in the forest make sure the username is one of these: A _________ administrator account An __________ administrator accountWhen you create an LDAP Account Unit for each domain in the forest make sure the username is one of these:
    • A Domain administrator account that is a member of the Domain Admins group in the subdomain. Enter the username as subdomain\user.
    • An Enterprise administrator account that is a member of the Enterprise Admins group in the domain. If you use an Enterprise administrator, enter the username as domain\user.
  33. 33Does Identity Awareness support the use of LDAP nested groups?Identity Awareness supports the use of LDAP nested groups. When a group is nested in another group, users in the nested group are identified as part of the parent group. For example, if you make Group_B a member of Group_A, Group_B members will be identified by Identity Awareness as being part of Group A.
  34. 34There are ____ ways to configure nested group queriesThere are three ways to configure nested group queries:
    • Recursive nested groups - The gateway sends a query with the user name to the LDAP server. The server finds the groups that the user is a member of and sends it to the gateway. To know if a group is nested in another group, and for each nesting level, you must send a new query. This feature is enabled by default. The default nesting depth is configured to 20.
    • Per-user nested groups - With one LDAP query, the response includes all groups for the given user, with all nesting levels. The server sends the groups of a given user as a flat list.
    • Multi per-group nested groups - The gateway sends one LDAP query, which includes the user name and the group. The server responds if the user is in this group or not.
  35. 35Is NAT between two Identity Awareness Security Gateways that share data with each other supported?NAT between two Identity Awareness Security Gateways that share data with each other is not supported
  36. 36How do you generate a Certificate Signing Request (CSR) for use in the captive portal?First, generate a Certificate Signing Request (CSR). The CSR is for a server certificate, because the gateway acts as a server to the clients. This procedure creates private key files. If private key files with the same names already exist on the computer, they are overwritten without warning.
    1. From the gateway command line, log in to expert mode.
    2. Run: cpopenssl req -new -out -keyout -config $CPDIR/conf/openssl.cnf
    This command generates a private key.
    Fill in the data.
    • The Common Name field is mandatory. This field must have the Fully Qualified Domain Name (FQDN). This is the site that users access. For example: portal.example.com.4. Send the CSR file to a trusted certificate authority. Make sure to request a Signed Certificate in PEM format. Keep the .key private key file.
  37. 37How do you generate a P12 file certificate for use in the captive portal?After you get the Signed Certificate for the gateway from the CA, generate a P12 file that has the Signed Certificate and the private key.
    1. Get the Signed Certificate for the gateway from the CA. If the signed certificate is in P12 or P7B format, convert these files to a PEM (Base64 encoded) formatted file with a CRT extension.
    2. Make sure that the CRT file has the full certificate chain up to a trusted root CA.
    Usually you get the certificate chain from the signing CA. Sometimes it split into separate files. If the signed certificate and the trust chain are in separate files, use a text editor to combine them into one file. Make sure the server certificate is at the top of the CRT file.3. From the gateway command line, log in to expert mode.
    4. Use the *.crt file to install the certificate with the *.key file that you generated.
    a) Run:
    cpopenssl pkcs12 -export -out -in -inkey
  38. 38SSO in Windows domains works with the ________ authentication protocolSSO in Windows domains works with the Kerberos authentication protocol.
    The Kerberos protocol is based on the concept of tickets, encrypted data packets issued by a trusted authority, Active Directory (AD). When a user logs in, the user authenticates to a domain controller that gives an initial ticket granting ticket (TGT). This ticket vouches for the user's identity.
  39. 39How Transparent Kerberos Authentication Works regarding a Kerberos Ticket?when an unidentified user is about to be redirected to the Captive Portal for identification:
    1. Captive Portal asks the browser for authentication.
    2. The browser shows a Kerberos ticket to the Captive Portal.
    3. Captive Portal sends the ticket to the gateway (the Security Gateway enabled with Identity Awareness).
    4. The gateway decrypts the ticket, extracts the user's identity, and publishes it to all Security Gateways with Identity Awareness.
    5. The authorized and identified user is redirected to the originally requested URL.
    6. If transparent automatic authentication fails (steps 2-5), the user is redirected to the Captive Portal for identification.
  40. 40Transparent Kerberos Authentication uses the ___-API Negotiation Mechanism (SPNEGO) internet standard to negotiate KerberosTransparent Kerberos Authentication uses the GSS-API Negotiation Mechanism (SPNEGO) internet standard to negotiate Kerberos
  41. 41You can configure SSO Transparent Kerberos Authentication to work with ____ and/or _____ connectionsYou can configure SSO Transparent Kerberos Authentication to work with HTTP and/or HTTPS connections. HTTP connections work transparently with SSO Transparent Kerberos Authentication at all times. HTTPS connections work transparently only if the Security Gateway has a signed .p12 certificate.
  42. 42Brief configuration overview for Browser-based Transparent Kerberos Authentication SSOTransparent Kerberos Authentication SSO configuration includes these steps.
    - AD configuration - Creating a user account and mapping it to a Kerberos principal name
    • For HTTP connections: (HTTP/@DOMAIN)
    • For HTTPS connections: (HTTPS/@DOMAIN)
    - SmartConsole configuration
    • Creating an LDAP Account Unit and configuring it with SSO.
    • Enabling Transparent Kerberos Authentication on the Security Gateway configured with Identity Awareness.
  43. 43What utility do you use to map the User Account to a Kerberos Principal Name? _____ is a command line utility that is available for Windows ServerRun the setspn utility to create a Kerberos principal name, used by the Security Gateway and the AD. A Kerberos principal name contains a service name (for the Security Gateway that browsers connect to) and the domain name (to which the service belongs).
  44. 44To configure an Account Unit and Transparent Kerberos Authentication for SSO, what is it necessary?-> LDAP Account Unit
    b) In Profile, select Microsoft_AD.
    d) Select CRL retrieval and User management
    6. Click Active Directory SSO configuration and configure the values:
    a) Select Use Kerberos Single Sign On.
    Enabling Transparent Kerberos Authentication
    3. Click Identity Awareness > Browser-Based Authentication > Settings.
    The Portal Settings window opens.
    4. Select Authentication Settings - Edit.
    The Authentication Settings window opens.
    5. Select Automatically authenticate users from machines in the domain.
    • Main URL: The URL used to begin the SSO process. If transparent authentication fails, users are redirected to the configured Captive Portal.
    • IP Address: The IP address to which the Portal URL is resolved if DNS resolution fails.
  45. 45To work with Transparent Kerberos Authentication, it is necessary to configure your browser to ____ Captive Portal URL.To work with Transparent Kerberos Authentication, it is necessary to configure your browser to trust Captive Portal URL.
  46. 4650How dows SSO for Endpoint Identity Agent work?This is the workflow for SSO (Single Sign On):
    1. The user logs in to the computer and authenticates to the AD server.
    2. The AD send an initial ticket (TGT) to the computer.
    3. The Endpoint Identity Agent connects to the Security Gateway, which then requests the identity.
    4. The Endpoint Identity Agent requests an SR (service ticket) for the Security Gateway and presents the TGT to the AD server.
    5. The AD server sends the SR to the computer.
    The user name is encrypted with the shared secret between the Security Gateway and the AD server.
    6. The Endpoint Identity Agent sends the SR to the Security Gateway
    7. The Security Gateway uses the shared secret to decrypt the ticket and confirms the user identity.
    8. The user can access the Data Center.
  47. 47Brief configuration overview for Endpoint Identity Agent Transparent Kerberos Authentication SSO (same as Browser-based )SSO Configuration
    SSO configuration includes two steps:
    • AD Configuration - Creating a user account and mapping it to a Kerberos principal name.
    • SmartConsole Configuration - Creating an LDAP Account Unit and configuring it with SSO.
  48. 48What does Server discovery and Server trust mean for Endpoint Identity Agent client?The Endpoint Identity Agent client needs to be connected to a Security Gateway with Identity Awareness. For this to happen, it must discover the server and trust it.
    Server discovery refers to the process of deciding which server the client should connect to
    Server trust refers to the process of validating that the server the end user connects to is indeed a genuine one
    The trust process compares the server fingerprint calculated during the SSL handshake with the expected fingerprint. If the client does not have the expected fingerprint configured, it will ask the user to verify that it is correct manually
  49. 49options that the client has for discovering a server and creating trust with it:?• File name based server configuration – If no other method is configured (default, out-of-the-box situation), any Endpoint Identity Agent downloaded from the portal will be renamed to have the portal computer IP in it. During installation, the client uses this IP to represent the Security Gateway with Identity Awareness. Note that the user has to trust the server by himself (the trust dialog box opens).
    • AD based configuration – If client computers are members of an Active Directory domain, you can deploy the server addresses and trust data using a dedicated tool.
    • DNS SRV record based server discovery – It is possible to configure the server addresses in the DNS server. Because the DNS is not secure, we recommend that you do not configure trust this way. Users can authorize the server manually in a trust dialog box that opens. This is the only server discovery method that is applicable for the MAC OS Endpoint Identity Agent.
    • Remote registry
  50. 50What commands and proccess are used for identity awareness?◦ PDP - The process on the Security Gateway responsible for collecting and sharing identities.
    ◦ PEP - The process on the Security Gateway responsible for enforcing network access restrictions.
    Decisions are made according to identity data collected from the PDP.
    ◦ AD Query - AD Query is the module responsible for acquiring identities of entities (users or
    computers) from the Active Directory (AD). AD Query was called Identity Logging in previous
    versions and in some cases is also referenced as AD Log. The adlog is the command line process
    used to control and monitor the AD Query feature.
    ◦ test_ad_connectivity - A utility that runs connectivity tests from the Security Gateway to an AD
    domain controller.
    The PEP and PDP processes are key components of the system. Through them, administrators control
    user access and network protection.
    AD Query can run either on a Security Gateway that has been enabled with Identity Awareness or on a
    Log Server. When it runs on a Security Gateway, AD Query serves the Identity Awareness feature, and
    gives logging and policy enforcement. When it runs on

Information

Description
User has deleted their subject information Flashcards on Identity Awareness, created by Deleted user on 29/05/2019.
Created by
Deleted user
Views
24
History
  • Created by brian gustavo triviño taborda · May 21, 2019
  • Copied by brian gustavo triviño taborda · May 29, 2019
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?