topic Re: Remote VPN Machine Authentication in SASE and Remote Access

Remote VPN Machine Authentication

Daniel_3 — Tue, 15 Oct 2024 19:49:22 GMT

Hello,

I am currently implementing remote VPN with machine authentication for our company and our customers and partners.

I configured VPN for ourself, an IT provider, and one of our customers. Each has its own VPN gateway.

For the VPN authentication we use Active Directory. Provider and customer have their own AD, completely seperated.

For the machine certificates we used seperate sub CAs but both are using the same root CA.

I also got a user in our customers AD domain since I am one of the firewall admins and we have to do basic login tests after implementing changes which will affect remote VPN. We also use a seperate test client for that which is connected to our customers AD.

Now the issue is, that that my companys client (which is not part of the customers AD) is also able to login to the customers VPN gateway even though my machine name is not registered in the customers AD. So the machine authentication should fail.

There is no machine identity in the logs and it also shows the different AD name but the login is still successful.

My guess is, that this is possible because both are using the same root CA.

I tried to use the branch filter in the root CA settings in SmartConsole but I could not figure out the correct syntax and there seems to be no configuration examples online.

Did anyone use this filter already and got it to work? Or is there another solution for this issue?

We are using R81.20 on firewalls and the client version is E88.30 and E88.70 (Windows and MacOS clients).

Re: Remote VPN Machine Authentication

PhoneBoy — Tue, 15 Oct 2024 20:45:12 GMT

Are all the gateways managed by the same management or different ones?

Re: Remote VPN Machine Authentication

Daniel_3 — Tue, 15 Oct 2024 20:46:40 GMT

They are managed by separate management servers.

Re: Remote VPN Machine Authentication

PhoneBoy — Tue, 15 Oct 2024 20:57:57 GMT

I assume in each management server, the external CA is imported.
It looks like this is where you would specify the relevant DN for that organization's certificates.
I assume each organization (with a different SubCA) has a unique DN for its certificates.
Could be wrong about that, as this is not a configuration I've seen before.

Re: Remote VPN Machine Authentication

Daniel_3 — Tue, 15 Oct 2024 21:42:40 GMT

Yes, that is the exact setting I played around with. But I was not able to figure out the syntax to filter out the machines which are not part of the corresponding domain. Login was either still possible for all clients or for none.

Re: Remote VPN Machine Authentication

PhoneBoy — Tue, 15 Oct 2024 21:54:11 GMT

Have you reviewed the certificates issued by the various sites to see their complete DN?
What should be in this field is a partial DN, and it should be unique to the site in question.

Re: Remote VPN Machine Authentication

Daniel_3 — Wed, 16 Oct 2024 08:03:09 GMT

I already tried the following:

CN=domain.net

CN=IntermediateCA

CN=IssuingCA

For the two CAs I tried both, the partial DN and the full DN.

But I keep getting the error "Name constraints checking failed." on the client.

Re: Remote VPN Machine Authentication

PhoneBoy — Wed, 16 Oct 2024 13:25:05 GMT

Have you tried using ldapsearch on the CLI?
Perhaps that will provide a bit more visibility into what’s going on (and possibly finding the correct syntax).

Re: Remote VPN Machine Authentication

Daniel_3 — Thu, 17 Oct 2024 09:45:17 GMT

But is this branch filter about LDAP branches? My understanding is that the root CA does not have visibility of LDAP branches.

Re: Remote VPN Machine Authentication

PhoneBoy — Thu, 17 Oct 2024 15:42:35 GMT

The CA does not, correct, but the certificates themselves have an LDAP path associated with them.

Re: Remote VPN Machine Authentication

Daniel_3 — Fri, 18 Oct 2024 10:13:20 GMT

I tried several variations of the LDAP paths now, but still no luck.

Re: Remote VPN Machine Authentication

PhoneBoy — Fri, 18 Oct 2024 18:22:28 GMT

Unfortunately, the only suggestion I can offer here is to open a TAC case: https://help.checkpoint.com

Re: Remote VPN Machine Authentication

Daniel_3 — Thu, 24 Oct 2024 20:04:43 GMT

Ok, yes I have a TAC case open now. Thanks for you efforts to help!
I will update this thread when I found a solution.