> Source: [sk106965](https://support.checkpoint.com/results/sk/sk106965)

# sk106965 - Identity Sharing does not work with an SMB appliance acting as PEP

| Property | Value |
|----------|-------|
| Solution ID | sk106965 |
| Date Created | 2015-07-27 |
| Last Modified | 2023-02-27 |
| Technical Level | General |
| Products | Security Gateway, Spark Firewall (Locally Managed) |
| Versions | R82.10, R82, R81.20, R82.00.X, R81.10.X |
| Platform | 20, 400, 110 |

## Symptoms

- * Identity Sharing does not work with SMB appliance (running R77.20.75 or below) acting as PEP Gateway- PDP Gateway cannot establish secure connection with PEP Gateway or vice versa.

* The "*pdp connections pep*" command on PDP Gateway shows that PEP Gateway (SMB appliance) is disconnected:

  ```
  
  --------------------------------------------------------------------------------------------------
  | Direction | IP      | Port  | Name | Type           | Status       | Location | IPv6 Supported |
  --------------------------------------------------------------------------------------------------
  | Outgoing  | X.X.X.X | 15105 | PEP  | Single Gateway | Disconnected | Remote   | Yes            |
  ```

* *$FWDIR/log/sfwd.elg* file on SMB appliance (acting as PEP Gateway) shows:

  ```
  
  [sfwd <PID> ...]@HostName[Date Time] PM_policy_query: rule not found.
  [sfwd <PID> ...]@HostName[Date Time] PM_policy_query: finished successfully. 1st method = deny
  [sfwd <PID> ...]@HostName[Date Time] PM_policy_choose: finished successfully. choose: DENY.
  [sfwd <PID> ...]@HostName[Date Time] policy_choose: choose failed.
  [sfwd <PID> ...]@HostName[Date Time] sic_client_negotiate_auth_method: policy choose failed.
  [sfwd <PID> ...]@HostName[Date Time] SIC Error for PEPC: Client could not choose an authentication method for service PEPC
  ```

* On the pdpd side under debug the following error appears:   

  `[BasicSicServer (TD::Important)] NAC::IS::BasicSicServer::NewConnection: failed connecting from client <Ip>:<high_port>, sic error: (null)`

## Cause

In R77.20.75 or below, the SMB appliance (PEP Gateway) does not see the NAC rules in the *$CPDIR/conf/sic_policy.conf* file. This leads to rejecting the request from PDP Gateway to establish the connection.

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R77.20.80](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk123294)

<br />

If you choose not to upgrade, do these steps:

1. Connect to the SMB device acting as a PEP Gateway (over SSH, or console).  

2. Log in to the Expert mode.  

3. Edit the *$CPDIR/conf/sic_policy.conf* file in Vi editor.  

   ***\[Expert@HostName\]# vi $CPDIR/conf/sic_policy.conf***   

4. Add the following rules:  

   * In the ***\[Outbound rules\]*** section - below the ***#NAC*** subsection:

     ```
     # NAC
     VPN    ; PDP        ; ANY    ; PEPC   ; sslca
     PEP,PDP; PEP,PDP    ; ANY    ; NAC    ; sslca
     PEP,PDP; PEP,PDP    ; ANY    ; PEPC   ; sslca
     PEP,PDP; ANY ; ANY ; PEPC ; sslca
     ```

   * In the ***\[Inbound rules\]*** section - below the ***#NAC*** subsection:

     ```
     # NAC
     PDP    ; VPN        ; ANY    ; PEPC   ; sslca
     PEP,PDP; PEP,PDP    ; ANY    ; NAC    ; sslca
     PEP,PDP; PEP,PDP    ; ANY    ; PEPC   ; sslca
     ANY ; ANY ; ANY ; PEPC ; sslca
     ```

5. Restart all Check Point services on the SMB appliance:

   ***\[Expert@HostName\]# cpstop ; cpstart***
6. Restart the PDP daemon on the PDP Security Gateway:

   1. Connect to the command line.  

   2. Log in to the Expert mode.  

   3. Restart the DPD daemon:  

      ***\[Expert@HostName\]# fw kill pdpd***

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content