topic Re: VPN using certificates between two different Checkpoint domains in Firewall and Security Management

VPN using certificates between two different Checkpoint domains

Ilovecheckpoint — Mon, 11 Mar 2024 17:46:38 GMT

Hello,

I have two MDS domains, so gateways are managed by a different SMS.

Between these gateways a vpn site to site is up and running on PSK.

I want switch from PSK to Certificate issue by Internal CA.

I imported the "partner" root CA on trusted CA OPSEC PKI server objects.

Error message, invalid certificate and invalid cookie.

Verificated root certificates MD5 fingerprints and it is fine.

What I have missed?

I found a guide but it is for SMB only.

Re: VPN using certificates between two different Checkpoint domains

the_rock — Mon, 11 Mar 2024 18:01:49 GMT

Can you send a screenshot?

Andy

Re: VPN using certificates between two different Checkpoint domains

RS_Daniel — Mon, 11 Mar 2024 18:15:47 GMT

Hello,

On i think you have an externally managed vpn gateway object on each SMS. Di you configure certificate matching criteria on these objects? you should specify the CA the issued the certificate and the DN. Should be done on both sides.

Re: VPN using certificates between two different Checkpoint domains

Ilovecheckpoint — Mon, 11 Mar 2024 21:47:23 GMT

I have selected on each external managed gateways the certificate issue by the other internal domain CA and the DN, but no improvements. I will recheck the configuration and I will run a vpn debug, hoping ikeview will help. Thanks

Re: VPN using certificates between two different Checkpoint domains

Ilovecheckpoint — Fri, 15 Mar 2024 14:49:24 GMT

I deleted OPSEC PKI and created EXTERNAL CA trust server object and it works, traffic pass into vpn.

Anyway, the following message appears from time to time: "Certificate defaultCert cannot be validated. Could not retrieve CRL."

Executed telnet to management ip on port 18264 and it shows as open. Gateway is version 80.20. Any suggestion?