topic Re: Identity Awareness collector agent and GW VPN certificate renewal in Firewall and Security Management

Identity Awareness collector agent and GW VPN certificate renewal

cem82 — Sun, 21 Jan 2024 21:27:09 GMT

The gateway VPN certificates are coming up to expire so need to renew those. I gather though that that is the certificate that is used for trust between the identity collector agent. Is there anything that needs to be done on the IA Agent server as well and would there be impact for when we do the renewal on the GW in terms of identities? We're not using third party certificate provider for this.

Re: Identity Awareness collector agent and GW VPN certificate renewal

the_rock — Sun, 21 Jan 2024 21:42:50 GMT

Normally, you would get at least one week warning, but with R81+, I believe its 60 days. There is no risk, you can easily do it in the middle of the day. I done so with customers many times before and was fine. Though, to be 100% sure, maybe better do it after normal working hours. I never even seen a single case where any VPN tunnel went down when this was done. To my recollection, there was never an issue with IA agents either.

Best,

Andy

Re: Identity Awareness collector agent and GW VPN certificate renewal

cem82 — Mon, 22 Jan 2024 04:49:43 GMT

Thanks for the advice and didn't have any blips for IA or need to do anything on the collector side which is great 🙂

Re: Identity Awareness collector agent and GW VPN certificate renewal

the_rock — Mon, 22 Jan 2024 12:03:43 GMT

Good to hear 🙂

Andy

Re: Identity Awareness collector agent and GW VPN certificate renewal

Sajid_Abbas — Mon, 29 Jan 2024 23:40:38 GMT

Could you please advise on how to renew this certificate or how can i check the expiration date. The gateway is only running ID blade and not any VPN blade. The ID collector says VPN certificate so where do I view or renew on the Gateway

Re: Identity Awareness collector agent and GW VPN certificate renewal

the_rock — Mon, 29 Jan 2024 23:49:59 GMT

I was referring to vpn cert, which would be there if you are running vpn blade on the fw. If not, maybe attach a screenshot, so we can verify.

Best,

Andy

Re: Identity Awareness collector agent and GW VPN certificate renewal

cem82 — Mon, 29 Jan 2024 23:59:32 GMT

You need to temporarily enable IPSEC VPN blade, then IPSec VPN then select the cert and click renew then disable VPN blade again. You don't need to push after enabling/disabling is just to get the VPN section in GW properties to appear. I did have an SK showing this but can't find it at the moment but will add if I can find it

This should give the expiry date

cpca_client lscert -stat Valid -kind IKE

Re: Identity Awareness collector agent and GW VPN certificate renewal

the_rock — Tue, 30 Jan 2024 00:05:04 GMT

That for sure makes sense to me. Just doing some Azure studying now, but will check later in the lab,

Best,

Andy

Re: Identity Awareness collector agent and GW VPN certificate renewal

the_rock — Tue, 30 Jan 2024 00:34:31 GMT

@Sajid_Abbas Just tested what @cem82 said, worked exactly how he described.

Best,

Andy

Re: Identity Awareness collector agent and GW VPN certificate renewal

CheckPointerXL — Thu, 08 Feb 2024 20:19:36 GMT

Hey bro, this one?

https://support.checkpoint.com/results/sk/sk97792

Re: Identity Awareness collector agent and GW VPN certificate renewal

cem82 — Thu, 08 Feb 2024 20:47:00 GMT

Was a combination of these. There was another one that said to run a tcpdump as well to see cert expiry that got me on the right track but can't locate or that SK has been updated/removed to not show that bit anymore

https://support.checkpoint.com/results/sk/sk113021

https://support.checkpoint.com/results/sk/sk105723

https://support.checkpoint.com/results/sk/sk97792

Re: Identity Awareness collector agent and GW VPN certificate renewal

the_rock — Thu, 08 Feb 2024 20:52:12 GMT

Good job!