topic Re: Peer sent wrong DN in General Topics

Peer sent wrong DN

Moudar — Tue, 10 Sep 2024 14:05:50 GMT

I got a route based VPN between 1575 SMB and a 6500 gateways.

On Smartconsole it looks like this:

Where the SMB that got the problem is test7

On Smartevent monitor test7 is waiting:

The problem began immediately after upgrading the SMS to take 76.

What’s odd is that the tunnel is still functioning correctly. On the other side, there’s a Cisco AP that connects to its WLC on my side without any issues!

I checked sic_info.elg on SMB I could see this log:

CLIENT; process: fw; my port: 42545; peer port: 18191; my ip addr: 192.168.7.10; peer ip addr: x.x.x.x; sic service type: EntitlementManager; fwasync state: SIC_CLIENT_GET_SICNAME; error id: 111; SIC Error for EntitlementManager: Peer sent wrong DN: CN=fw01,O=xxxx.xxxx.xxxx.xxxxxx

On 6500 cluster object the CN=fwcl

I wonder why the SMB is getting CN=fw01, where fw01 is a gateway on fwcl cluster!

How to import the correct certificate to the SMB, is it "Reinitialize Trusted communication"?

Re: Peer sent wrong DN

G_W_Albrecht — Tue, 10 Sep 2024 14:57:30 GMT

Yes, see https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Setting-Management-Mode.htm

Re: Peer sent wrong DN

Moudar — Tue, 10 Sep 2024 15:19:37 GMT

What should i look at? The SMB is already centrally managed?

Re: Peer sent wrong DN

Lesley — Tue, 10 Sep 2024 16:50:18 GMT

I think this is a known limitation:

SmartView Monitor

SMBGWY-2525

The SmartConsole "Device & License Information" window shows incorrect information for the Centrally Managed Quantum Spark Gateway in these scenarios:

The Centrally Managed Quantum Spark Gateway is configured with a Dynamically Assigned IP Address (DAIP)
There is a NAT device between the Check Point Management Server and the Centrally Managed Quantum Spark Gateway

To get to this window:

In SmartConsole, from the left navigation panel, click the "Gateways & Servers" view.
Select the Quantum Spark Gateway object.
In the bottom pane, click the "Summary" tab.
At the bottom, click the link "Device & License Information".

Re: Peer sent wrong DN

the_rock — Tue, 10 Sep 2024 17:15:11 GMT

Have you tried rebooting that SMB gateway?

Andy

Re: Peer sent wrong DN

Moudar — Tue, 10 Sep 2024 20:53:13 GMT

yes, same !

Re: Peer sent wrong DN

the_rock — Wed, 11 Sep 2024 02:51:28 GMT

But you say the tunnel shows as up? Both phase 1 and 2? Is the traffic through it working?

Andy

Re: Peer sent wrong DN

Moudar — Wed, 11 Sep 2024 06:22:21 GMT

No, the tunnel doesn't appear as up, as shown in the images above, but it is functioning correctly.

Re: Peer sent wrong DN

the_rock — Wed, 11 Sep 2024 11:24:16 GMT

So where is it failing? Phase 2?

Re: Peer sent wrong DN

Moudar — Wed, 11 Sep 2024 14:09:45 GMT

cpca_client lscert -dn "CN=fwcl" cpca_client lscert -dn "CN=fw01"

Upon reviewing the 6500 certificates, I discovered the following:

CN=fw01: This certificate is valid until 2028.
CN=fwcl: This certificate is currently listed in the gateway VPN repository.

The issue is that the VPN peers are receiving the DN CN=fw01 certificate instead of the DN CN=fwcl certificate.

Question: Why is the VPN peer receiving the CN=fw01 certificate instead of the CN=fwcl?