topic Negotiation with Site failed - SAML in SASE and Remote Access

Negotiation with Site failed - SAML

nflnetwork29 — Fri, 12 May 2023 14:18:02 GMT

Mgmt R81.20

I have setup Azure Identity provider for SAML authentication .

When I try to connect i get prompted for Azure username/ password, then do my 2FA, then get redirected to a page that says VPN connection successful .

However on the actual client i see that the connection failed with the following message

"Negotiation with site failed"

I also checked azure sign logs and it shows a successful sign-on ,

Any ideas what could be the issue?

I am using latest E87.30 vpn client software

Re: Negotiation with Site failed - SAML

the_rock — Fri, 12 May 2023 14:38:22 GMT

Personally, I would collect client logs and have a look, as well as below from gateway:

1) First, please set up the client side debug. (On the workstation)
Right click on the client icon --> VPN Options --> Advanced --> enable logging checkbox --> click close.
Enable extended logging instead of basic if there is an option.

2) Initiate VPN debug on the FW:
# rm $FWDIR/log/ike.elg.*
# rm $FWDIR/log/ikev2.xmll.*
# rm $FWDIR/log/iked.elg.*
# rm $FWDIR/log/vpnd.elg.*
# rm $FWDIR/log/legacy_ike.*
# rm $FWDIR/log/legacy_ikev2.xmll.*
# > $FWDIR/log/ike.elg
# > $FWDIR/log/ikev2.xmll
# > $FWDIR/log/iked.elg
# > $FWDIR/log/vpnd.elg
# > $FWDIR/log/legacy_ike.elg
# > $FWDIR/log/legacy_ikev2.xmll
# vpn debug trunc
# vpn debug on TDERROR_ALL_ALL=5

3) <<<<Replicate the issue>>>>>

4) Stop VPN debug on the FW:
# vpn debug off
# vpn debug ikeoff

5) Right click on the client icon --> VPN Options --> Advanced --> collect logs --> click close.

Re: Negotiation with Site failed - SAML

the_rock — Wed, 17 May 2023 19:44:39 GMT

Hey @nflnetwork29 ...any luck with this?

Andy

Re: Negotiation with Site failed - SAML

nflnetwork29 — Wed, 17 May 2023 20:11:48 GMT

i got this working by following a combination of these two links.

https://community.checkpoint.com/t5/Security-Gateways/Access-Role-not-working/m-p/144456#M22486

https://www.youtube.com/watch?v=yZVB3sJ3fZ8

Re: Negotiation with Site failed - SAML

the_rock — Wed, 17 May 2023 21:04:30 GMT

Excellent, thanks for sharing! 👍