Scaled Identity Sharing

Scaled Identity Sharing is an improved way for Policy Decision Point (PDP) Check Point Identity Awareness Security Gateway that acts as Policy Decision Point: acquires identities from identity sources; shares identities with other gateways. Identity Awareness Check Point Software Blade on a Security Gateway that enforces network access and audits data based on network location, the identity of the user, and the identity of the computer. Acronym: IDA. Gateways to share identity information with Policy Enforcement Point (PEP) Check Point Identity Awareness Security Gateway that acts as Policy Enforcement Point: receives identities via identity sharing; redirects users to Captive Portal. With Scaled Sharing, you can create simple configurations to share identities from a PDP to up to 300 PEPs. Scaled Sharing simplifies the user experience of Check Point administrators, reduces hardware cost, and reduces maintenance burden.

Scaled Sharing uses the industry standard TLS protocol. The older Identity Sharing method uses the Check Point proprietary SIC Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server. The new Scaled Identity Sharing (TLS-based) and the older Identity Sharing mechanism (SIC-based) are both supported.

With TLS-based Scaled Sharing, a PDP can directly share identities with a PEP located in a different Management Domain managed by the same Multi-Domain Security Management. With SIC-based Identity Sharing, sharing between Management Domains is possible only with additional configuration of an Identity Broker Identity Sharing mechanism between Identity Servers (PDP): (1) Communication channel between PDPs based on Web-API (2) Identity Sharing capabilities between PDPs - ability to add, remove, and update the identity session. By removing the need for an Identity Broker, Scaled Sharing greatly simplifies sharing across Management Domains.

Comparison between Identity Sharing (SIC-based) and Scaled Identity Sharing (TLS-based)

Comparison of Topology for SIC-based and TLS-based Identity Sharing

SIC-based Identity Sharing - Example Topology
In a SIC-based Identity Sharing configuration, several PDP Identity Broker Gateways may be required to share identities with PEP Gateways. Identity Brokers are needed to process a large number of identities, and share with many PEP Gateways, and share identities with PEP Gateways in a different Management Domain. Administrators must manage and monitor each of the PDP Identity Broker Gateways.

TLS-based Scaled Sharing - Example Topology
In a typical TLS-based Scaled Sharing configuration, a single PDP can share identities with many PEPs. No Identity Broker is needed. Fewer Security Gateways are needed to handle the same load. This reduces hardware costs and administrative burden.

Comparison of Communication between PDP and PEP for SIC-based Identity Sharing and TLS-based Scaled Identity Sharing

SIC-based Identity Sharing: Communication between PDP and PEP
In SIC-based Identity Sharing, there are two separate communication channels between the PDP and each PEP. In the "Networks registration" channel, the PEP queries the PDP for information about IP address ranges. In the "Identity Propagation" channel, the PDP sends information about users on these networks to the PEP.

TLS-based Scaled Sharing: Communication between PDP and PEP
In TLS-based Scaled Identity Sharing, there is one communication channel between the PDP and each PEP. The PDP is a TLS server, and the PEP is a TLS client. This communication is simpler than the two channels used in SIC-based Identity Sharing.

Scaled Sharing Prerequisites and Known Limitations

Scaled Sharing Prerequisites

• The PDP Gateway must be version R82.10 or higher.
• The PEP Gateways must be version R82.10 or higher.
• A Management Server that manages a Scaled Sharing Gateway (PDP or PEP) must be version R82.10 or higher.

Scaled Sharing Known Limitations

• Quantum Force 3900 series appliances are not supported as PDPs for Scaled Sharing. These appliances are supported as PEPs for Scaled Sharing.
• Scaled Sharing does not support identities that the PDP received from Check Point Identity Agent for a Terminal Server (also known as Multi-User-Host (MUH)).
• Scaled Sharing between different Domains is supported only if both Domains are managed by the same Multi-Domain Security Management. For sharing between Domains managed by different Multi-Domain Security Management, use Identity Broker.
• It is not supported for the same physical appliance to host Security Gateway(s) that act as a Scaled Sharing PDP and a Scaled Sharing PEP.

Enabling Scaled Identity Sharing in the same Management Domain

Scaled Sharing must be enabled on all participating PDP and PEP Gateways.

Step 1: In SmartConsole, enable Identity Sharing on the Security Gateway you want to be the PDP

1. From the left navigation panel, click Gateways & Servers.
2. Open the applicable Security Gateway object.
3. From the left tree, click Identity Awareness > Identity Sharing.
4. Click Share local identities with other gateways.
5. Click OK.

Step 2: In SmartConsole, enable Identity Sharing on the Security Gateways you want to be the PEP

1. Open the applicable Security Gateway object.
2. From the left tree, click Identity Awareness > Identity Sharing.
3. Click Get identities from other gateways.
4. Below Get identities from other gateways, to the right of the table, click the plus button.
5. Select the PDP Security Gateway that you want to use for Scaled Sharing.
6. Click OK.

Step 3: With Management API, enable Scaled Sharing for the PDP and the PEP Security Gateways

Do this step for every PDP and PEP Gateway that does not already have Scaled Sharing enabled. Run the relevant API command on the Security Management Server / Domain Management Server for the PDP Security Gateway / Cluster and for each PEP Security Gateway / Cluster:

Step 4: Install Policy

1. Install the Access Control policy on the PDP Gateway.
2. Install the Access Control policy on each PEP Gateway.

Scaled Identity Sharing for PDP Gateways in different Management Domains

Scaled Identity Sharing supports identity sharing between a PDP and a PEP that are in different Management Domains in the same Multi-Domain Security Management. To share identities between a PDP and a PEP that are managed by different Multi-Domain Security Management Servers, use Identity Broker.

Monitoring Scaled Sharing

This section includes monitoring that is specific to Scaled Sharing. Monitoring of the connection between the PDP Gateway and the PEP Gateway is the same for Scaled Sharing and for SIC-based Identity Sharing.

Renewing the PDP Gateway's TLS Server Certificate for Scaled Sharing

1. Run the relevant API command on the Security Management Server / Domain Management Server for the PDP Security Gateway / Cluster and for each PEP Security Gateway / Cluster:

2. Install the Access Control policy on each Security Gateway / Cluster object.

Disabling Scaled Identity Sharing

After you disable Scaled Sharing, the PDP uses SIC-based Identity Sharing. Configurations of PEP Gateways in the same Management Domain are preserved. Configurations of PEP Gateways in a different Domain are not preserved.