Alright, I need to tap into the collective wisdom here. I'm in the middle of what should be a straightforward deployment for a client—extending their on-prem Quantum Security Gateways to recognize users via Azure AD for policy enforcement—and the Identity Awareness (IA) module is proving to be anything but reliable. We keep falling back to IP-based rules, which defeats the entire purpose of moving to a zero-trust model.
The setup is classic for a hybrid environment:
* Gateways (R80.40) on-premises.
* Azure AD as the identity source, using the Identity Agent (Windows) installed on a dedicated server.
* We've configured the Azure AD Connector in SmartConsole, and the test connection passes.
* The goal is simple: apply firewall rules based on Azure AD security groups.
Here’s where the "battle scars" come in. The connection seems to drop intermittently. Users will be identified for a few hours, then the gateway stops receiving updates. The logs in SmartConsole show the Identity Agent is "Connected," but user mappings stop populating. We've had instances where a user's laptop will be identified correctly, but their desktop won't, even though both are Azure AD-joined and on the same subnet.
We've been through the checklist:
* Verified the Identity Agent server has uninterrupted outbound HTTPS access to both the gateways and Azure AD endpoints.
* Confirmed the service account has the correct "Directory Readers" role in Azure.
* Ensured the gateway's time is synced with the AD domain controllers and Azure.
* Toggled the IA blade off and on (more times than I care to admit).
This feels like one of those integration nuances that isn't fully captured in the admin guide. Has anyone else fought this particular dragon and lived to tell the tale? I'm especially interested in:
* Any known issues with specific R80.40 Jumbo Hotfix Accumulators and Azure AD Connector stability?
* Is there a more robust logging method for the Identity Agent itself beyond the standard `identity_agent.log`? We're not seeing clear errors there.
* Would moving to a CloudGuard Identity Awareness approach be more stable, or are we just swapping one set of challenges for another?
* Any subtle Azure AD conditional access or security default that could be silently blocking the agent's queries?
My client is losing patience, and frankly, so am I. We sold them on a seamless, identity-aware layer of security, and right now it's more of a "sometimes-aware" situation. Any deep-dive insights or war stories would be hugely appreciated.
Implementation is 80% process, 20% tool.