topic Re: The issue with DynamicID in SASE and Remote Access

The issue with DynamicID

PhongNN — Mon, 17 Feb 2020 11:53:49 GMT

Hi everybody

I am trying to configure Remote Access with DynamicID on R80.10 GW

I have a URL from SMS server Team to perform GET method to SMS server like this:

http://x.x.x.x:8083/VPNOTP/http/sendmsg?api_id=$APIID&user=vpnotp&password=xxx&to=0901441294&text=TestVPN

When i paste that link to a browser, i get an OTP code to my phone number

But when I run curl_cli on GW, the SMS server return to 505 Internal Error

I tried to capture packet, and I saw all field after "api_id=" was missing when run curl_cli

Is it due to a link error or is it because I incorrectly executed the syntax?

Thank you so much

Re: The issue with DynamicID

G_W_Albrecht — Mon, 17 Feb 2020 13:36:13 GMT

sk160112: 'Dynamic Id authentication failed' error message while trying to connect to Mobile Access portal

sk109435: SMS with DynamicID verification code does not arrive after user successfully authenticated to Mobile Access Portal

Re: The issue with DynamicID

PhongNN — Tue, 18 Feb 2020 02:17:45 GMT

Both 2 sk do not help me in this case 😄

Thank you

Re: The issue with DynamicID

AndresMunoz — Mon, 08 Jun 2020 19:43:24 GMT

Hey buddy,

Did you solve it?

Re: The issue with DynamicID

PhongNN — Tue, 09 Jun 2020 07:05:14 GMT

Hi Andres

Yes, I solve this case

I put links in quotes and I can run curl_cli normally

Note: In R80.x Check Point have integrated new I/S for DynamicID.
As part of this change, we have decided to verify the server reply, and as part of it, we are not accepting HTTP 500 replies.
This change was done for security and better code flow decisions. Because of this, with many case upgrade from R77 to R80.x, DynamicID cannot work

Thanks

Re: The issue with DynamicID

MartinTzvetanov — Wed, 10 Jun 2020 07:50:19 GMT

I faced a problem with DynamicID at a customer. The SMS provider serves the api on http and https, but https works only with certificate. I had a case with CheckPoint regarding the situation and they said that the problem is in the certificate. I found a configuration file where you explicitly configure not to check the certificate (the same -k option you enter with curl/curl_cli) but it didn't work.

Anybody faced the same issue?

Re: The issue with DynamicID

AndresMunoz — Wed, 10 Jun 2020 14:31:29 GMT

Hey Martin.

Did you modify this file? $CVPNDIR/bin/sendsms

Regards,

Re: The issue with DynamicID

MartinTzvetanov — Wed, 10 Jun 2020 14:39:42 GMT

Hey,

I found this and change it following the document:

Maybe you mean to replace "${args[@]}" directly with -k ?

send_sms() {
$FWDIR/bin/curl_cli "${args[@]}" -D - -o /dev/null -s --disable-crl-check

Re: The issue with DynamicID

henry_shih — Sat, 10 Jul 2021 15:28:53 GMT

We are in the process of selecting a SMS provider. Can you tell me who your SMS provider is?

Thanks.

Re: The issue with DynamicID

Ruan_Kotze — Sat, 10 Jul 2021 19:02:03 GMT

Not OP - but I use Clickatell in my labs and demos and it works well.

Re: The issue with DynamicID

henry_shih — Sat, 10 Jul 2021 22:31:16 GMT

Please see the attached file, what is the correct information (format and syntax) you put into the SMS settings field?

In check Point Admin. Guide, they have two examples. (not working at all). We would like to learn the correct configuration to put in.

a) To let the DynamicID code to be delivered by SMS only, use the following syntax:
https://api.example.com/http/sendmsg?api_id=$APIID&user=$USERNAME&password=$PASSWORD&to=$PHONE&text=$MESSAGE

c) To let the DynamicID code to be delivered by SMS or email, use the following syntax:
sms:https://api.example.com/sendsms.php?username=$USERNAME&password=$PASSWORD&phone=$PHONE&smstext=$MESSAGE mail:TO=$EMAIL;SMTPSERVER=smtp.example.com;FROM=sslvpn@example.com;BODY=$RAWMESSAGE

Re: The issue with DynamicID

Ruan_Kotze — Sun, 11 Jul 2021 12:24:05 GMT

This is my Clickatell SMS string. The x's in the string is my API key:

https://platform.clickatell.com/messages/http/send?apiKey=xxxxxxxxxxxxxx&to=$PHONE&content=$MESSAGE