Check Point Identity Awareness Empty: adlog a query When Access Roles Miss

Check Point · Techclick CLI troubleshooting lab

Access role 'Finance' is in the rule. Users are not matching. AD is healthy.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Check Point for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

If adlog cannot map the IP to a user, the access role is empty for that session. Fix the association, not the rule.

Why this ticket shows up

Identity Awareness is a mapping engine. A perfect role-based rule is a source-any rule until the IP is associated.

Symptoms operators actually see

• Logs show no user

• adlog query empty

• Captive portal not hitting

• PDP/PEP out of sync

CLI first — copy this block

Run these on the Check Point device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

adlog a query ip 10.40.12.18
adlog a dc
pdp monitor ip 10.40.12.18
pep show user all | grep 10.40.12.18
fw tab -t user_ident -u | grep 10.40.12.18

How to read that output

adlog must return the user and groups. Empty query means the DC log or identity collector never saw the login.

Triage order

1. Query the IP

2. Check DC connectivity from the gateway

3. Confirm the user is in the AD group used by the role

4. Re-associate with captive portal or identity collector

5. Retest the role rule

Classic traps

What you see	Real cause	Fix
Add the subnet to the rule	IA is the fault	Fix mapping
Restart AD	Gateway cannot read security logs	Fix collector
Disable IA	One DC is stale	Point at a healthy DC

Proof the ticket is closed

• adlog shows the user

• Log line includes the access role

• Finance rule hits

Say this in an interview

I do not debug an access-role rule until adlog maps the IP.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/