> Source: [sk183268](https://support.checkpoint.com/results/sk/sk183268)

# sk183268 - Users from Terminal Server Identity Agent (MUH Agent) servers do not match rules with access roles

| Property | Value |
|----------|-------|
| Solution ID | sk183268 |
| Date Created | 2025-03-19 |
| Last Modified | 2026-02-17 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * Users on Terminal Servers (MUH v1 and v2) do not match rules with access roles. When this happens, the Security Gateway fails to recognize their user identity and does not apply the correct access permissions.
* The user association exists on the PDP (# pdp monitor ip ) and on the PEP (# pep show user query cid )
* Debug logs collected with the "*fw ctl debug -m IDAPI* " command shows "*ip not found in pep_src_mapping_db;*".

## Cause

There was an issue with handling the kernel table entries that associate a user's session id to their port/id range when the relevant agent was configured with dual-stacked IP addresses.  

Duplicate entries could occur due to a failure to remove expired entries from this table (pep_id_port_range / pep_port_range_db).  

Despite the MUH agent correctly transmitting user identity information, a non-existent user session could be returned from the kernel table query in this scenario leading to the user not being recognized.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 44
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 119
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 183

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).  

In case of a cluster, after installing the HF (Also can be applied as a workaround before installing the HF), you also need to clear the Identity Awareness Kernel tables on all members at the same time.  
**NOTE: This should be performed after working hours or maintenance as it will clear all Identity awareness information.**   
The information will be learned again when users connect to Windows again, or when the agents reconnect to the GW.

In case of a VSX, run the command from the relevant VS ID context (vsenv \<VS ID\>).  
# cat $FWDIR/lib/nac_tables.def \| grep dynamic \| cut -d ' ' -f1 \| grep -v idp \| awk '{ print ("-t "$0"")}' ORS=" " \| awk '{print "fw tab " $0 "-x -y"}' \| bash ; fw kill pdpd ; fw kill pepd  

In case of a Maestro Security Group, please run the following command instead:  
# cat $FWDIR/lib/nac_tables.def \| grep dynamic \| cut -d ' ' -f1 \| grep -v idp \| awk '{ print ("-t "$0"")}' ORS=" " \| awk '{print "g_fw tab " $0 "-x -y"}' \| bash ; g_fw kill pdpd ; g_fw kill pepd

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content