topic Re: Capsule VPN - Fallback to CRL after OCSP is unsuccessful in Firewall and Security Management

Capsule VPN - Fallback to CRL after OCSP is unsuccessful

D_W — Wed, 27 Jul 2022 11:57:22 GMT

Hello,

we have problems using Capsule VPN and our new certificates.

According sk179434 the SecGateway will check the CRL when OCSP is not available. We have a OSCP URL defined but it's not active at the moment. Issue is now that we do not see the Fallback. Gateway Version is R81.10 JHF T55.

Do I misunderstand the sk179434?

I also tried to deactivate the validation of the CA but that seems to be ignored.

Any idea anyone?

KR
David

Re: Capsule VPN - Fallback to CRL after OCSP is unsuccessful

Chris_Atkinson — Wed, 27 Jul 2022 12:33:45 GMT

Have you also reviewed sk21156 (in full) as a workaround?

Re: Capsule VPN - Fallback to CRL after OCSP is unsuccessful

D_W — Thu, 28 Jul 2022 08:04:29 GMT

Checked now SK21156.

It is in a very confusing layout and I cannot find new information.

I already disabled "Retrieve CRL From -> LDAP Servers and HTTP Servers" for the new CA Object.
Pushed the policy and also changed some settings in the VPN section so that the service also reloads.
I assume TAC is needed.

KR
David

Re: Capsule VPN - Fallback to CRL after OCSP is unsuccessful

spottex — Tue, 16 May 2023 21:16:54 GMT

Late response but the OSCP failback does not work R81.10 ikev2 jumbo 79 and below. TAC adding fix for Ikev2 and say Ikev1 not affected
If the OCSP fails to connect the Auth fails. Fix for sk179434 is available from TAC if not yet in Jumbo.