> Source: [sk182717](https://support.checkpoint.com/results/sk/sk182717)

# sk182717 - Identity awareness logs show that a user logged in with the source IP of the gateway

| Property | Value |
|----------|-------|
| Solution ID | sk182717 |
| Date Created | 2024-09-27 |
| Last Modified | 2024-09-30 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- 1. **Identity Source Configuration**   
   The Identity Collector is used as the primary identity source.
2. **Log Analysis**   
   SmartConsole logs for the "Identity Awareness" blade indicate user and machine logins originating from the Security Gateway's source IP address. For instance, the PDP monitor output demonstrates a session associated with a user configured in the LDAP Account Unit, identified by the firewall's IP address. Below is an example output:


       > 
       > # pdp m ip 10.xx.xx.x
       > Session: example
       > Session UUID: 
       > IP: 10.xx.xx.x 
       > Users: 
       >   - 10.xx.xx.x {example} 
       >   - Log Username: Administrator
       >   - Groups: All Users
       >   - Roles: Client 
       >   - Type: Identity Collector (Active Directory) 
       >   - Authentication Method: Trust 
       >   - Distinguished Name: CN=Administrator, CN=Users,DC=lms,DC=identity,DC=local 
       >   - Connect Time: Wed Sep 25 10:42:10 2024 
       >   - Next Reauthentication: Thu Sep 26 06:29:39 2024 
       >   - Next Connectivity Check: - 
       >   - Next LDAP Fetch: Wed Sep 25 23:12:45 2024 
       >   - Packet Tagging Status: Not Active 
       >   - Published Gateways: Local
       >         

   In this example, the IP address **10.xx.xx.x** represents the firewall's IP, and **Administrator** is the user configured in the LDAP Account Unit.
3. **Machine Identity Association**   
   If machine identity is employed, the logs will additionally reference the machine identity of the Domain Controller (one of the servers configured within the LDAP Account Unit).
4. **Remote Access VPN and Identity Collector**   
   If the identity sources include Remote Access VPN and Identity Collector, the logs and PDP outputs reflect symptoms similar to those described above. However, instead of the LDAP Account Unit user, the associated user is the Remote

## Cause

When the Security Gateway authenticates users and machines within the environment, it executes an `ldapsearch` command directed to the domain controller to retrieve the corresponding user or machine information. This operation uses the credentials stored in the **LDAP Account Unit**.

After the firewall successfully sends a **BindRequest** , a login event is generated on the domain controller. This event is subsequently captured by the **Identity Collector**, which forwards it to the Security Gateway for authentication.

As a result, logs and the **PDP** may display a super session for the user of the **LDAP Account Unit**, the machine identity of the domain controller, and the gateway's IP address.

#### Example of such an event in the Domain Controller (DC):

> An account was successfully logged on.
**Subject:**

* Security ID: SYSTEM
* Account Name: example
* Account Domain: LMS
* Logon ID: 0x3E7

**Logon Information:**

* Logon Type: 3
* Restricted Admin Mode: -
* Virtual Account: No
* Elevated Token: Yes

**Impersonation Level:** Impersonation **New Logon:**

* Security ID: LMS\\Administrator
* Account Name: Administrator
* Account Domain: LMS
* Logon ID: example
* Linked Logon ID: example
* Network Account Name: -
* Network Account Domain: -
* Logon GUID: {00000000-0000-0000-0000-000000000000}

**Process Information:**

* Process ID: example
* Process Name: C:\\Windows\\System32\\lsass.exe

**Network Information:**

* Workstation Name: example
* Source Network Address: 192.xxx.x.xxx
* Source Port: 35017

*** ** * ** ***

The same scenario occurs when a user enters credentials to log in to the endpoint client's VPN. In this case, the firewall uses the provided credentials and sends an `ldapsearch` using **CLDAP** (LDAP over UDP).

This action generates a login event reflecting the username from the Remote Access VPN, the machine identity of the domain controller, and the gateway's IP address.

#### Example of such an event in the Domain Controller (DC):

> An account was successfully logged on.
**Subject:**

* Security ID: example
* Account Name: example
* Account Domain: LMS
* Logon ID: 0x3E7

**Logon Information:**

* Logon Type: 3
* Restricted Admin Mode: -
* Virtual Account: No
* Elevated Token: Yes

**Impersonation Level:** Impersonation **New Logon:**

* Security ID: example\\engineer
* Account Name: engineer
* Account Domain: LMS
* Logon ID: example
* Linked Logon ID: example
* Network Account Name: -
* Network Account Domain: -
* Logon GUID: {00000000-0000-0000-0000-000000000000}

**Process Information:**

* Process ID: 0x28c
* Process Name: C:\\Windows\\System32\\lsass.exe

**Network Information:**

* Workstation Name: example
* Source Network Address: 192.xxx.x.xxx
* Source Port: 10016

<br />

Logs in the Smart Console:  
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182717/sk182717202409291625091.png)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content