You are using the Identity Collector with Identity Awareness in large environment. Users report that they cannot access resources on Internet. You identify that the traffic is matching the cleanup…

Question

Options

• Apep debug idc on
• Bpdp debug set IDP all all
• Cad query | debug on
• Dpdp connections idc

• A
  4% (2)
• B
  15% (8)
• C
  8% (4)
• D
  74% (39)

Explanation

pdp connections idc queries the Policy Decision Point (PDP) daemon to display active connections from the Identity Collector, confirming whether IDC is successfully sending identity mappings (user-to-IP) to the gateway - which is exactly what you need to diagnose why Access Roles aren't matching traffic.

Why the distractors are wrong:

• A (pep debug idc on) - Not a valid Check Point command; the PEP enforces policy but has no idc debug sub-command in this form.
• B (pdp debug set IDP all all) - This enables verbose debugging for the Identity Provider (IDP/SAML) flow, not the Identity Collector; different identity source, wrong tool.
• C (ad query | debug on) - Not a valid command; Active Directory queries use adlog utilities, and this syntax doesn't exist in the Check Point CLI.

Memory tip: Think of it as asking the decision-maker (PDP) whether its informant (IDC) is on the line - "pdp connections idc" = "PDP, are you connected to IDC?" If that connection is broken, no identity data flows and traffic falls through to the cleanup rule.

No community discussion yet for this question.