For roaming users, typically using corporate-managed laptops, Identity Agents are the best deployment method. The agent is installed on the user's computer and transparently provides user and machine identity information to the Security Gateway. This method is seamless for the user, does not require repeated logins (unlike a captive portal), and provides robust identity information for use in the Access Control policy, regardless of the user's location.

A. Use Office Mode: Office Mode is a feature of IPsec VPN that assigns an internal IP address; it is not a primary method for acquiring user identity.

C. Share user identities between gateways: This is a mechanism for synchronizing identity data between gateways for scalability, not a method for acquiring identity from an end-user.

D. Use captive portal: A captive portal requires active user login through a web browser, which is intrusive and less suitable for corporate roaming users than a transparent agent.

1. Check Point. (2023). R81.20 Identity Awareness Administration Guide. Page 13, "Identity Sources". States, "For roaming users, we recommend to use an Identity Agent."

2. Check Point. (2023). R81.20 Identity Awareness Administration Guide. Page 43, "Identity Agent". Describes the agent as providing "transparent authentication from the user's computer."