The interview question that trips up 70% of candidates
Senior interview: "What's the difference between a PDP and a PEP, and can the same gateway be both?"
Wrong answers: "They're the same thing", "PDP is the management server". Right answer: PDP (Policy Decision Point) is the gateway that learns identities from sources (AD Query, Captive Portal, Identity Agent). PEP (Policy Enforcement Point) is the gateway that applies user-based rules. A single small gateway plays both. In larger deployments, one or two strategic gateways play PDP and share identity with many PEPs over SIC. Knowing this topology lets you scale to 50k users without putting AD Query load on every branch.
💡 The college canteen ID-card analogy
You walk into the college canteen. The reception scans your ID card — that's identity acquisition (the PDP doing AD Query). The scanner pings the college server: "Sneha CS-Final-Year, year 2026, dietary preference veg, monthly limit ₹3000". You then approach the counter and order biryani. The counter staff doesn't re-scan your ID — they look up the record reception just made, check today's spending, and serve you. The counter is the PEP. Same Sneha at different counters (food, books, hostel-laundry) means many PEPs but one PDP. That's why the topology matters.
4 things you'll be tested on before we begin
A single rule object that combines User + Machine + Network + Time. Use in Source/Destination of any Access Control rule. Replaces 4 separate columns with one matchable object.
Secure Internal Communication — mutual TLS between mgmt + gateways, also between PDP and PEPs. Identity flows over SIC encrypted. No SIC = no identity propagation.
Default 720 min (12h). User logs off — gateway keeps the identity until timeout OR explicit logoff signal (rare). Tune down for shared kiosks; tune up for stable office desks.
Service accounts (backup runners, scanners, monitoring) appear in AD as logins but aren't real users. Always bypass via the dedicated list or you'll mis-attribute SOC traffic to "svc_backup".
① AD Query — transparent identity, the default 80% of deployments use
AD Query (ADQ) parses the Windows Security Event Log on Domain Controllers over WMI / RPC, looking for event IDs 4624 (logon success) and related. When Rahul logs into his Wipro laptop, the DC writes event 4624 → ADQ on the gateway reads it within seconds → gateway maps 10.20.5.50 → user=rahul.kumar, machine=WIPRO-LAP-2245.
AD Query needs Windows DCs to log event 4624. Default Server policies often have "Audit Logon Events" disabled or set to Failures only. Enable via Default Domain Controllers Policy → Computer → Advanced Audit → Logon/Logoff → Audit Logon = Success+Failure. Without this, ADQ silently learns zero users. Symptom: "Identity Awareness configured but no rules ever match by user".
② Captive Portal — when ADQ can't see them
BYOD phone, Mac without domain join, contractor laptop — none of these generate AD logon events. Captive Portal redirects them to a browser-based auth page on the gateway. They log in once → gateway maps their IP to a user → rules fire.
③ Identity Agent + Terminal Server Agent — when accuracy matters
Identity Agent (IA) is a Windows MSI installed on user endpoints. It signs in directly with the gateway over Kerberos, reporting login/logout in real time. Comes in Light (no UI, GPO-deployed) and Full (with system tray). Best for regulated industries (BFSI, healthcare) where mis-attributing traffic is a compliance fail.
Terminal Server Agent (TSA) solves the "many users, one IP" problem on Citrix and RDS farms. TSA monitors the server's session table and tells the gateway: "TCP source port 47000-47200 belongs to user1, 47201-47400 belongs to user2…". Without TSA, Citrix traffic from 200 users all looks like one IP and you cannot enforce per-user policy.
▶ Watch identity propagate end-to-end
Rahul boots his laptop → Kerberos logon → AD Query → PDP → PEP at branch → user-based rule fires. Press Play.
10.20.5.50.WIPRO\rahul.kumar, machine = WIPRO-LAP-2245, IP = 10.20.5.50.10.20.5.50 belongs to rahul.kumar.rahul.kumar. Allow.Sneha enables Identity Awareness with AD Query. Configured the LDAP account unit, pointed at DCs, gave the service account "Read security event log" rights. After install, no identity is acquired for any user. What's the most likely cause?
auditpol /get /category:"Logon/Logoff" in PowerShell — Success+Failure for "Logon" must be ON.④ PDP/PEP topology — the design decision that scales
Small deployment (single gateway): same box is both PDP and PEP. Done.
Large deployment: designate 1–2 PDP gateways (typically in the DC, near AD DCs for low-latency WMI polls) and let them learn identities. PEP gateways at every branch subscribe via SIC. AD Query load stays at the DC; branches just enforce. This scales to 50k+ users without putting WMI load on every gateway.
Access Roles — the rule object that replaces 4 columns
Access Role = User/Group + Machine + Network + Time. Drop one Access Role object into the Source column of an Access Control rule and you get all four conditions matched at once. The shift from R77.30 thinking ("source = IP subnet") to R80+ thinking ("source = HR-Team Access Role") is the single biggest productivity win in identity-aware policy.
Karthik runs a 12-branch Check Point fleet with 1 DC. He wants to scale Identity Awareness without adding load to branch gateways. What's the design?
Service accounts + identity bypass — the audit trail saver
Backup runners, scanners, monitoring scripts log into your AD every minute. ADQ sees these as "user logons" and attributes their traffic. Now your SOC sees svc_veeam_backup as the user who transferred 4 TB last night. Useless attribution.
SmartConsole → Identity Awareness blade → Identity Sources → AD Query → Excluded users/machines. Add a regex like ^svc_ or list each service account. Now ADQ ignores those logons; SOC sees the source IP and at least can investigate without misleading attribution.
🤖 Ask the AI Tutor
Tap any question — instant context-aware answer.
Deeper questions → chat.techclick.in.
The 5 mistakes that cost L1/L2 candidates the interview
"Identity Awareness configured but nothing matches" — DCs aren't writing 4624. Enable Audit Logon Success in Default Domain Controllers Policy.
SOC sees svc_* as the user. Add service accounts to the Excluded list.
200 users sharing one source IP = one giant attribution mess. Deploy TSA on the Citrix server.
Every branch doing its own ADQ over the WAN melts the DCs. Centralize PDPs near DCs; branches enforce only.
Server VLANs (10.50.0.0/16) shouldn't be in Captive Portal redirect scope. You'll break monitoring/backup traffic. Always exempt server networks.
📝 Check your understanding — 10 questions, 70% to pass
Q1–Q2 above already count. Below are Q3 to Q10.
Which Windows Event ID does AD Query primarily parse to learn user logons?
Aditya needs to allow only the AD group "FinanceTeam" to access SAP between 09:00-19:00 IST from domain-joined laptops on the HQ WiFi subnet. Which is the cleanest design?
Priya configures Identity Awareness with ADQ. pdp monitor all shows users learned correctly. But on a branch PEP gateway, pep show user query ip <test-ip> returns empty. What's broken?
pdp monitor all); PEP doesn't (pep show empty). The only thing between them is SIC. Either SIC isn't established, or a firewall between PDP and PEP blocks port 18211. (a/b) would prevent PDP from learning, not propagation.Sneha runs a Citrix farm. 200 users connect via published apps. SmartLog shows ALL Citrix traffic attributed to the same user. Why and what's the fix?
SOC reports that user "svc_veeam_backup" downloaded 4 TB overnight. Veeam is your backup service account. What's the right fix?
^svc_ covers the whole family.Rahul deploys Identity Agent (Light, GPO-pushed) on all 5000 endpoints. Why is this better than ADQ alone for a BFSI deployment?
For a 50k-user fleet across 30 sites, what's the right Identity Awareness topology?
After CVE-2024-24919, what's the right hygiene for Identity Awareness in production?
Next up — Check Point Threat Prevention Suite
Now your rules know WHO. Next: IPS, Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction — the 5 blades that catch what shouldn't be there.