topic Re: R81 - New VPN users unable to establish VPN via SHA256 in SASE and Remote Access

R81 - New VPN users unable to establish VPN via SHA256

Danny — Wed, 17 Mar 2021 15:13:44 GMT

In our R81 lab we encountered an interesting issue with CAPI certificate enrollment for new VPN users.
Existing VPN users don't experience this issue.

When using SHA256 for data integrity the VPN site creation within the VPN client succeeds, but afterwards the VPN connection to the R81 VPN server fails. With SHA1 connecting to the VPN server succeeds.

TAC support writes:

According to the logs, our failure is most probably related to the hashing algorithm, which is currently SHA256

[ 5048 8084][15 Mar 17:32:00][IKE] create_MM5(certificates authentication): Failed to sign hash (-996)
[ 5048 8084][15 Mar 17:32:00][rais] [DEBUG] [RaisMessages::CreateMessageSet(s)] message: (msg_obj
   :format (1.0)
   :id (ClipsMessagesInternalError)
   :def_msg ("Internal error; connection failed. More details may be available in the logs")
   :arguments ()

I suggest changing the data integrity hashing algorithm to SHA1 instead

Go to 'Global Properties > Remote Access > VPN – Authentication and Encryption > Encryption algorithms > IKE Security Association (Phase 1)'.
Make sure that "SHA1" is selected under "Support Data Integrity".
Select "SHA1" under "Use Data Integrity".
Click "OK".
Install policy.

Why doesn't Check Point R81 support the more secure SHA256 algorithm for VPN Remote Access for new users, which was working in previous versions? Tested with Endpoint Security Client E82.40 (working), E83.30 & E84.50 not working.

@amitshr

Re: R81 - New VPN users unable to establish VPN via SHA256

PhoneBoy — Thu, 18 Mar 2021 02:23:18 GMT

We’ve supported SHA-256 for many many versions.
Seems like some issue comes up with CAPI which is also…not new.
Did TAC suggest: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116997&partition=Advanced&product=Endpoint

Re: R81 - New VPN users unable to establish VPN via SHA256

amitshr — Thu, 18 Mar 2021 05:26:03 GMT

According to the R&D, it seems to be a bug, and it is currently investigated on their end.

Re: R81 - New VPN users unable to establish VPN via SHA256

Christoph_Hornu — Wed, 05 May 2021 07:36:22 GMT

Any Update on this behaviour, may it get fixed in E81?

Re: R81 - New VPN users unable to establish VPN via SHA256

Dilian_Chernev — Wed, 30 Jun 2021 12:09:24 GMT

We hit the same issue with R80.40 JHF236, using machine certificate from CAPI and E84.00 client.
Error messages in trac.log are the same.

Lowering Data Integrity to SHA1 is a working solution, but hope this bug will get fixed soon.