topic Re: SMB IPSec VPN Certs - Internal CA in Spark Firewall (SMB)

SMB IPSec VPN Certs - Internal CA

T_L — Thu, 18 Apr 2024 17:47:52 GMT

Good Afternoon --

Does anyone have any scripts or scripting mojo that would allow the IPSec VPN certs to be renewed on a bunch of 1400/1500 centrally managed SMB gateways all at once?

We have a large number of SMBS (R77.20 - R81.x) centrally managed by a physical 3150 SMS_r81.10. All the gateways are configured in permanent tunnels utilizing the local CP internal CA on each. We have had to renew the certs manually/ individually on all of them.

The majority of the GWs are 1400 series on the R77.20 code so scripting from the SMS is a no go -- but something we could run from the local CLI - that we could could pipe to all our SSH sessions at once would work.

Thanks!

Re: SMB IPSec VPN Certs - Internal CA

PhoneBoy — Mon, 22 Apr 2024 14:13:27 GMT

How are you using the ICA of the SMB device if the devices are centrally managed?
The ICA, in this case, would be on your Smart-1.

The good news is that we're about to release a script that will assist with this task.
It does require being on a specific R81.10/R81.20 JHF level at time of writing.

Re: SMB IPSec VPN Certs - Internal CA

Lesley — Mon, 22 Apr 2024 15:46:53 GMT

I am not aware of a script. But the renewal takes places on the mgmt. There you renew the cert and push it out via policy push.

That is why I don't think you can run a script on the box itself.

Now the steps are not to bad, if I assume you renew it on the fw object in Smart Console and press the renew button, correct?

You can also think about to extend to cert time from 1 year to 3 year: https://support.checkpoint.com/results/sk/sk176527

This will save a bit of work until there is something new as PhoneBoy posted.

Re: SMB IPSec VPN Certs - Internal CA

T_L — Mon, 22 Apr 2024 16:52:16 GMT

Yes - the ICA is used from the object on the SMS - I misspoke. My intention was to indicate there was no type of external/ 3rd party cert being utilized.

SK176527_31539 - this is the procedure used - it just takes a long time if you have you hundreds!

But I think we will be ok increasing the cert time in the SMS.

Thanks!