topic Re: Certificate VPN doesn't work in SASE and Remote Access

Certificate VPN doesn't work

Polina_1 — Tue, 07 Mar 2023 05:45:28 GMT

Good afternoon!
I have a problem with VPN connection with Endpoint Security VPN.
The certificate issued on EPS version 86.60 does not work on another computer with EPS version 86.60.
But this certificate works well on computer with EPS version 85.00.
Could you tell me what the problem is?

Re: Certificate VPN doesn't work

Chris_Atkinson — Tue, 07 Mar 2023 07:59:22 GMT

What type of certificate is used and what is the error that you see on the client when it doesn't work?

Re: Certificate VPN doesn't work

PhoneBoy — Tue, 07 Mar 2023 19:57:23 GMT

Does it work with E85.00 and not work with E86.60 on the exact same computer?
Might need TAC to assist with this.

Re: Certificate VPN doesn't work

the_rock — Tue, 07 Mar 2023 20:14:55 GMT

As @Chris_Atkinson asked, what type of cert is it? Are we talking the actual client cert or the vpn cert on the gateway?

Andy

Re: Certificate VPN doesn't work

Polina_1 — Thu, 09 Mar 2023 06:25:07 GMT

The type used is PKCS#12. No error messages appear when the client cannot connect to the gateway.

Re: Certificate VPN doesn't work

Polina_1 — Thu, 09 Mar 2023 06:29:25 GMT

Yes, this problem appears on the same computer.

Re: Certificate VPN doesn't work

Polina_1 — Thu, 09 Mar 2023 06:34:04 GMT

The type used is PKCS#12. Employees use hardware tokens with certificates.
We are talking about the actual client cert.

Re: Certificate VPN doesn't work

Andrew25 — Wed, 17 May 2023 15:43:41 GMT

Hello!

Problem solved, how? We are facing a similar problem.

Re: Certificate VPN doesn't work

the_rock — Wed, 17 May 2023 15:47:18 GMT

I would involve TAC for this.

Re: Certificate VPN doesn't work

stalindelatorre — Tue, 19 Nov 2024 15:02:14 GMT

Hi, I have the same issue with ESP 86.80 connecting to a VPN site to site on Quantum FW1595. Some computers with the same EPS work fine and others don't. The only difference I found is related to the internet provider, because some branches use different IPS for connecting to the firewall.

Does anybody knows how to fix this?

Re: Certificate VPN doesn't work

PhoneBoy — Tue, 19 Nov 2024 19:15:31 GMT

When you say "don't work" what exact symptoms and logs do you see?
The only time I've seen an issue related to ISP is when CGNAT is involved, which will sometimes change the IP during a session.
You can try forcing Visitor Mode, but I'm not sure how to do that on locally managed SMB appliances.
If centrally managed (with Smart-1), see: https://support.checkpoint.com/results/sk/sk107433