topic Re: 1490 SMB appliance VPN blade using central mgmt in Spark Firewall (SMB)

1490 SMB appliance VPN blade using central mgmt

FelipeTropeia — Mon, 06 Apr 2020 15:02:28 GMT

Hi All,

I'm trying to create a VPN Client (Capsule VPN for ios and android) on one of our 1490 SMB appliances running at R77.20.87 build 004 but the VPN blade is not active.
I have seen on mgmt server is activated and configurable but on the gateway I haven´t seen anything related to VPN.

There are some output logs below:

[Expert@Test]# vpn_configload -d
[ 32516 1737437184]@Test[3 Apr 11:06:01] cp_do_get_ipaddrs: The size needed is [160]
[ 32516 1737437184]@Test[3 Apr 11:06:01] get_CK_for_MAC_based_license_imp: features_str=[CPAP-AP1490 ENF-APP CPSB-FW CPSB-VPN CPSB-SSLVPN-200 CPSB-IA CPSB-ADNC CPSB-ADNC-M CPSB-IPS-S1 CPSB-URLF CPSB-APCL-S1 CPSB-AV CPSB-ABOT-S CPSB-ASPM]
[ 32516 1737437184]@Test[3 Apr 11:06:01] get_CK_for_MAC_based_license_imp: has valid MAC address syntax
[ 32516 1737437184]@Test[3 Apr 11:06:01] licdb_add_license: License was recognized as MAC based license
[ 32516 1737437184]@Test[3 Apr 11:06:01] fwa_set_sfw_installing_local_policy: Setting fwa_db_installing_local_policy to 1.
[ 32516 1737437184]@Test[3 Apr 11:06:01] fwa_set_sfw_convert_local_cfg to TRUE
[ 32516 1737437184]@Test[3 Apr 11:06:01] fwa_set_sfw_convert_local_cfg: Setting fwa_db_convert_local_cfg to 1.
Error: Not in local management mode
Unable to configure appliance:
Internal error.
[Expert@Test]#

[Expert@Test]# grep 1 /opt/fw1/conf/active_blades.txt | awk '{print $1,$3}'

IPS

AV 2

URLF

APCL

[Expert@Test]#

Anyone with the same problem or any suggestions?

Re: 1490 SMB appliance VPN blade using central mgmt

G_W_Albrecht — Mon, 06 Apr 2020 16:42:58 GMT

I would look into Embedded GAiA WebGUI Dashboard to enable VPN...

Re: 1490 SMB appliance VPN blade using central mgmt

FelipeTropeia — Tue, 07 Apr 2020 08:22:25 GMT

Hi @G_W_Albrecht

There is no way to switch from off to on using the webui. I believe somethings is going on when we use SMB appliance in central mgmt. For testing purposes, I have another SMB appliance locally and its possible to see VPN blade enabled.

Re: 1490 SMB appliance VPN blade using central mgmt

G_W_Albrecht — Tue, 07 Apr 2020 13:39:43 GMT

But it shows the VPN blade, disabled ? I would try to install last current firmware using USB and the issue should be resolved...

Re: 1490 SMB appliance VPN blade using central mgmt

FelipeTropeia — Tue, 07 Apr 2020 14:04:20 GMT

Unfortunately we don´t have remote hands due to covid-19 in our datacentre. In embedded gaia -> Security dashboard-> Remote Access and Site to Site VPN blades are off and there is no way to turn it on.

Re: 1490 SMB appliance VPN blade using central mgmt

PhoneBoy — Tue, 07 Apr 2020 18:27:28 GMT

In a centrally-managed SMB configuration, all relevant configuration for VPN is done on central management.
Nothing is configured on the WebUI of the SMB device.
When you push the relevant configuration from Central management, the blades will show as active.

Re: 1490 SMB appliance VPN blade using central mgmt

FelipeTropeia — Tue, 07 Apr 2020 18:55:02 GMT

Hi @PhoneBoy

I configured everything on the management server that presents the gateway object as a VPN ticked and all options to be configured, but on the gateway it does not activate the VPN blade.

Re: 1490 SMB appliance VPN blade using central mgmt

HristoGrigorov — Tue, 07 Apr 2020 19:32:55 GMT

Check /var/log/log/sfwd.elg. It is possible that policy was not installed at all.