What command would you run to verify the communication between the Security Gateway and the Identity Collector?

The command pdp connections idc is executed on the Security Gateway's command line in expert mode to verify the connection status to the Identity Collector. The Policy Decision Point (PDP) daemon (pdpd) on the gateway is responsible for communicating with Identity Sources, including the Identity Collector. This command specifically queries the PDP daemon for its current connections and filters the output to show only those related to the Identity Collector (idc), providing a direct way to confirm if the communication link is established and active.

A. fw ctl debug -m IDAPI: This is a kernel debug command that generates verbose, low-level logs for the Identity Awareness API module. It is used for in-depth troubleshooting, not for a simple connection status check.

C. fw ctl debug -m fw + nac: This command enables kernel debugging for the main firewall (fw) and Network Access Control (nac) modules. It is irrelevant for verifying the connection to an Identity Collector.

D. adlog: This command is used to view the adlog.elg file, which logs user identity information acquired from Active Directory. It shows the result of identity acquisition, not the live connection status.

1. Check Point SecureKnowledge (SK) Article SK134312: "Troubleshooting Identity Collector". In the section "Connectivity Issues", the article explicitly states: "On the Security Gateway, run this command to check the connection to the Identity Collector: [Expert@GW:0]# pdp connections idc".

2. Check Point R81.10 Identity Awareness Administration Guide: In the "Troubleshooting Identity Awareness" chapter, under the section "Important Identity Awareness Commands", the command pdp connections is listed to "Show connected clients". The idc argument filters this list for Identity Collectors.

3. Check Point SecureKnowledge (SK) Article SK108213: "Identity Awareness Best Practices". Under the "Troubleshooting" section, this article lists pdp connections as a useful command to "show all connected PDP clients", which includes Identity Collectors.