> Source: [sk181520](https://support.checkpoint.com/results/sk/sk181520)

# sk181520 - Delayed identity sync between PDP and PEP

| Property | Value |
|----------|-------|
| Solution ID | sk181520 |
| Date Created | 2023-10-17 |
| Last Modified | 2025-08-27 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Operations on the Identity Server \[PDP\] such as session creation or session revocation take several minutes to propagate to the Identity Gateway \[PEP\]. The Identity Server \[PDP\] and Identity Gateway \[PEP\] can be running on the same gateway in this scenario.
* The output of "netstat -nap" shows heavy activity on the Recv-Q and Send-Q for the connections between PDD and PEP. For example:

  `Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name `  
  `
  tcp 0 1754460 127.0.0.1:47733 127.0.0.1:15105 ESTABLISHED 230359/pdpd `  
  ` 
  tcp 5844445 0 127.0.0.1:15105 127.0.0.1:47733 ESTABLISHED 230572/pepd`
* The Identity Collector serves as the primary source of identity information in an environment where multiple users share workstations.

## Cause

The Identity Gateway, acting as the Policy Enforcement Point (PEP), is encountering difficulties in processing events from the Identity Server, which serves as the Policy Decision Point (PDP). The root cause of this issue is an exceptionally large volume of events being generated.  

By default, Identity Awareness for the Identity Collector is configured to accept one user per IP address. However, a situation arises where, if a new user logs onto a workstation where an existing user session is already established, an override decision is triggered.  

This situation becomes problematic when a significant number of workstations consistently exhibit this behavior. The high volume of events generated by these workstations overwhelms the Identity Server (PDP), causing delays in the processing of new events at the Identity Gateway (PEP).

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content