> Source: [sk102172](https://support.checkpoint.com/results/sk/sk102172)

# sk102172 - Some users randomly get a block page from Identity Awareness gateway

| Property | Value |
|----------|-------|
| Solution ID | sk102172 |
| Date Created | 2014-08-24 |
| Last Modified | 2019-01-16 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Some users randomly get a block page from Identity Awareness gateway - e.g., user authenticated by Identity Awareness gateway is able to connect to resources, but after several hours the authentication fails and user gets a block page.

* Output of '`pdp monitor ip`' command on PDP Gateway correctly shows the user mapping and access role.

* The traffic logs in SmartView Tracker show only user's IP address and not the username.

* The following steps resolve the issue, but only temporarily:

  1. Run '`pdp update all`' command on PDP Gateway.
  2. Run '`pdp update specific `*username*' command on PDP Gateway.
  3. Run '`pdp control revoke_ip `*ip_address*' command on PDP Gateway.
  4. Reboot the user's computer.

## Cause

When two PDP Gateways share the same identities to the same PEP Gateway, orphaned entries are generated on PEP Gateway in the kernel table '`pep_client_db`'.

Most of the time, each PDP Gateway publishes unique identities, but sometimes the same identity is published from both PDP Gateways.  
In such scenario:

1. When the first publish arrives (from PDP GW #1), proper entries are created in the kernel table '`pep_src_mapping_db`' and in the kernel table '`pep_client_db`'.
2. When the second publish arrives (from PDP GW #2), a new entry is added to the kernel table '`pep_client_db`' and the old entry in the kernel table '`pep_src_mapping_db`' is modified (to point to the new one). An old entry in the kernel table '`pep_client_db`' is not deleted.
3. When an identity is expired on PDP GW #2, it is revoked and, as a result, only the old entry in the kernel table '`pep_client_db`' remains. The administrator sees this identity on PEP Gateway, but it is not enforced.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content