topic Re: Identity collector "Wrong shared secret" in Firewall and Security Management

Identity collector "Wrong shared secret"

Moudar — Wed, 28 Feb 2024 18:20:37 GMT

Hi,

I have tried many times to add my gateway to IDC but still have same problem "Wrong shared secret"

I have tried difficult passwords and easy passwords with same result: "Wrong shared secret"

I run a lab environment gateway 81.10:

show version all Product version Check Point Gaia R81.10 OS build 335 OS kernel version 3.10.0-957.21.3cpx86_64 OS edition 64-bit

IDC was downloaded from this link:

https://support.checkpoint.com/results/sk/sk134312

Identity Collector - for Windows OS

install policy and then test in IDC and then same "Wrong shared secret"

any ideas on what is wrong?

Re: Identity collector "Wrong shared secret"

the_rock — Wed, 28 Feb 2024 19:55:56 GMT

Never seen that before...I dont think version of IC would matter here. Make sure that everything is checked under authentication settings.

Best,

Andy

Re: Identity collector "Wrong shared secret"

Moudar — Wed, 28 Feb 2024 20:02:00 GMT

Re: Identity collector "Wrong shared secret"

the_rock — Wed, 28 Feb 2024 20:03:25 GMT

Let me check my lab that works.

Andy

Re: Identity collector "Wrong shared secret"

the_rock — Wed, 28 Feb 2024 20:07:45 GMT

What version is this? Is the IP you have there correct?

Andy

Re: Identity collector "Wrong shared secret"

Moudar — Wed, 28 Feb 2024 20:08:54 GMT

200.100.0.1 is the virtual IP of the cluster.

version 81.10

Re: Identity collector "Wrong shared secret"

the_rock — Wed, 28 Feb 2024 20:13:11 GMT

Are you able to ping the firewalls from IC machine?

Andy

Re: Identity collector "Wrong shared secret"

Moudar — Wed, 28 Feb 2024 20:16:21 GMT

10.0.0.2 is the active node

10.0.0.3 is standby

PS C:\Users\shanta> ping 10.0.0.2 Pinging 10.0.0.2 with 32 bytes of data: Reply from 10.0.0.2: bytes=32 time=1ms TTL=64 Reply from 10.0.0.2: bytes=32 time=1ms TTL=64 Reply from 10.0.0.2: bytes=32 time=16ms TTL=64 Reply from 10.0.0.2: bytes=32 time=1ms TTL=64 Ping statistics for 10.0.0.2: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 1ms, Maximum = 16ms, Average = 4ms PS C:\Users\shanta> ping 10.0.0.3 Pinging 10.0.0.3 with 32 bytes of data: Reply from 10.0.0.3: bytes=32 time=2ms TTL=64 Reply from 10.0.0.3: bytes=32 time=1ms TTL=64 Reply from 10.0.0.3: bytes=32 time=1ms TTL=64 Reply from 10.0.0.3: bytes=32 time<1ms TTL=64 Ping statistics for 10.0.0.3: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 2ms, Average = 1ms

Re: Identity collector "Wrong shared secret"

the_rock — Wed, 28 Feb 2024 20:19:28 GMT

Is VIP 10.0.0.4? Try that IP instead and see if it works. I mean, try that for gateway object in IC.

Andy

Re: Identity collector "Wrong shared secret"

Moudar — Wed, 28 Feb 2024 20:24:28 GMT

10.0.0.1 tested that, same problem!

Re: Identity collector "Wrong shared secret"

the_rock — Wed, 28 Feb 2024 20:26:57 GMT

Try this...remove the query pool and see if you get same issue. If so, then I would uncheck IA blade, install policy, recheck and teest.

Andy

Re: Identity collector "Wrong shared secret"

Moudar — Wed, 28 Feb 2024 20:33:48 GMT

I did both and still "Wrong shared secret"

I am very confused, I am trying this on my lab only to see if i get same problem as my production, which is that all logs are "failed log in"

but my lab environment refuses!! "Wrong shared secret"

Re: Identity collector "Wrong shared secret"

the_rock — Wed, 28 Feb 2024 20:36:21 GMT

And you are 100% positive you are typing the same secret?

Best,

Andy

Re: Identity collector "Wrong shared secret"

Moudar — Wed, 28 Feb 2024 20:37:50 GMT

very easy password: vpn123

https://www.youtube.com/watch?v=-CLuxHTewqg

check that video on 2:55, you can see that he had the same problem but found a solution that is not shown on the video

Re: Identity collector "Wrong shared secret"

Lesley — Wed, 28 Feb 2024 20:42:37 GMT

Follow this sk

https://support.checkpoint.com/results/sk/sk113021

Maybe something simple like closed port between IDC and gateway

Re: Identity collector "Wrong shared secret"

the_rock — Wed, 28 Feb 2024 20:44:08 GMT

So in that case, it was just new shared secret...not sure what else to say, sorry mate : - (. Lets see if Peter Elmer responds to your youtube video comment.

Best,

Andy

Re: Identity collector "Wrong shared secret"

Moudar — Wed, 28 Feb 2024 20:48:45 GMT

I got Windows firewall disabled for this test sake.

Would you explain: "

"Wrong Shared Secret" occurs when connecting a Security Gateway to Identity Collector if the Authrized Clients object defined within the Gateway Properties on SmartConsole has the wrong IP.

What is the "Authrized Clients object"?

Re: Identity collector "Wrong shared secret"

Lesley — Wed, 28 Feb 2024 21:04:38 GMT

This one is:

"Wrong Shared Secret" occurs when connecting a Security Gateway to Identity Collector if the Authrized Clients object defined within the Gateway Properties on SmartConsole has the wrong IP.

Do you see any traffic reaching on the fw? Should be HTTPS

Re: Identity collector "Wrong shared secret"

Moudar — Wed, 28 Feb 2024 21:07:04 GMT

I have now found the problem from the text of sk113021

the machine where IDC is installed "SmartConsole on my case" was not in there "Authorized Clients"

Re: Identity collector "Wrong shared secret"

the_rock — Thu, 29 Feb 2024 00:12:23 GMT

Ah, gotcha...good job. I just assumed machine you had there was the one where IC was installed.

Glad you got it now.

Best,

Andy