topic vpn-1 server could not find any certificate to use for IKE in Spark Firewall (SMB)

vpn-1 server could not find any certificate to use for IKE

MrDazana — Thu, 09 Feb 2023 21:42:49 GMT

Hi all,

I can't figure out what's going on and I hope someone here can help me. I have a 1570 with VPN blade active. My users are getting the following error msg "vpn-1 server could not find any certificate to use for IKE" when connecting with the checkpoint vpn client on mac or windows.

If I replace the certificate, they can connect but later get the error msg above when they reconnect.

If I reboot the router, it works fine, but then later fails with the same error on top when they reconnect.

I have 2 sites connecting to site to site and they work fine.

firmware version of the checkpoint is R81.10 (996000575)

Thanks

Re: vpn-1 server could not find any certificate to use for IKE

Chris_Atkinson — Thu, 09 Feb 2023 22:57:34 GMT

Typically this error does point to an issue with the certificates.

Out of interest which VPN client version is used here?

The newer R81.10.05 firmware (sk179797) is also worth considering if you want to exhaust options before consulting TAC.

Re: vpn-1 server could not find any certificate to use for IKE

MrDazana — Thu, 09 Feb 2023 23:06:08 GMT

I was using 86.50 and just upgraded to 86.80 with the same issue. Interesting enough, I reinitialized the internal certificate and it works for 3 mins then fails again. If I disable and reenable the the VPN blade, it works then fails 3 mins later

Re: vpn-1 server could not find any certificate to use for IKE

the_rock — Thu, 09 Feb 2023 23:10:44 GMT

One of my customers had same issue 2 years ago and this is what TAC recommended to fix it and worked fine. IF you do this, MAKE SURE to back up everything (mgmt, gateways), just in case.

Process:

1. Open Guidbedit to network_objects -> Gateway_Object -> VPN -> isakmp.authmethods - Change "signatures" to "pre-shared". - Save and exit Guidbedit.2. Open Guidbedit to network_objects -> Gateway_Object -> find certificates section - Find defaultCert then right click and delete the cert, and save changes and close 3. Check to see if default cert is gone in SmartConsole - gateway object - IPsec VPN - Create a new cert - Install policy4. Open Guidbedit to network_objects -> Gateway_Object -> VPN -> isakmp.authmethods - Change "pre-shared" to "signatures" - Save and exit Guidbedit. - Install policy5. Test VPN connection

Re: vpn-1 server could not find any certificate to use for IKE

Chris_Atkinson — Thu, 09 Feb 2023 23:13:11 GMT

For context is the appliance locally or centrally managed?

Re: vpn-1 server could not find any certificate to use for IKE

MrDazana — Thu, 09 Feb 2023 23:14:42 GMT

Managed Locally

Re: vpn-1 server could not find any certificate to use for IKE

the_rock — Thu, 09 Feb 2023 23:17:22 GMT

Nm then, process I gave wont apply, as guidbedit would not even come into place, since management part does not even exists. Personally, I would get on the phone and work with TAC, it sounds like a pretty serious issue that needs a remote session.

Re: vpn-1 server could not find any certificate to use for IKE

MrDazana — Thu, 09 Feb 2023 23:20:30 GMT

Ok Contacting TAC requires a subscription or contract support of some kind ?

Re: vpn-1 server could not find any certificate to use for IKE

Chris_Atkinson — Thu, 09 Feb 2023 23:40:47 GMT

Correct, the same contract provides entitlements to software downloads / version upgrades.

Re: vpn-1 server could not find any certificate to use for IKE

the_rock — Thu, 09 Feb 2023 23:59:08 GMT

Thats right...without it, they cant even open the case in the first place. Do you have a partner that you deal with that can open a case for you or no?

Re: vpn-1 server could not find any certificate to use for IKE

MrDazana — Fri, 10 Feb 2023 00:17:36 GMT

I just called my partner and they will send me info to get added to their account to open TAC. In the meantime. I'm resetting factory and going to test where it messes up and post my results here as well as contacting TAC

Re: vpn-1 server could not find any certificate to use for IKE

the_rock — Fri, 10 Feb 2023 00:20:08 GMT

Thats a very good idea. Im sure if you factory reset an appliance, it will most likely work. I did some research for you before, but could not find much sadly on the issue you had. Since I dont have embedded gaia appliance to test anything myself, it would be very hard to say for sure why the issue happened in the first place.

Re: vpn-1 server could not find any certificate to use for IKE

the_rock — Fri, 10 Feb 2023 00:46:30 GMT

In case you had not started reset yet, would you mind send us the screenshot of vpn certs showing in the GUI?

Andy

Re: vpn-1 server could not find any certificate to use for IKE

MrDazana — Fri, 10 Feb 2023 00:57:35 GMT

Reset already done 😕 I do have a backup of the device though

After resetting, I've had no issues and the clients can connect way after 3 mins.

It worth noting that I followed the link that phoneboy left in the issue I was having last Saturday which foxed that issue.

https://community.checkpoint.com/t5/SMB-Gateways-Spark/Odd-behavior-using-pppoe-on-Fibre/m-p/170349#M8170

Other than that, nothing really fancy as setup wise on my end . Simple 3 vlan setup, 5 users for vpn and 2 site to site links

Re: vpn-1 server could not find any certificate to use for IKE

MrDazana — Fri, 10 Feb 2023 01:00:28 GMT

Spoke to soon , it just failed again

Re: vpn-1 server could not find any certificate to use for IKE

the_rock — Fri, 10 Feb 2023 01:02:06 GMT

Good deal. Well, everyone knows phoneboy is right 99.999% of the time...only time I recall he was wrong was when he said that jumbo hotfixes are included in fw backup, other than that, cant ever remember him being wrong : -)

Re: vpn-1 server could not find any certificate to use for IKE

the_rock — Fri, 10 Feb 2023 01:04:09 GMT

Can you attach a backup, I can check tomorrow. By the way, sorry for my ignorance, Im not overly familiar with these embedded gaia appliances, but if you go to remote access vpn section, does it give a list of the vpn certs there?

Re: vpn-1 server could not find any certificate to use for IKE

MrDazana — Fri, 10 Feb 2023 01:04:50 GMT

here is the capture of the vpn cert

Re: vpn-1 server could not find any certificate to use for IKE

the_rock — Fri, 10 Feb 2023 01:07:18 GMT

Question...can you make sure users actually see the fingerprint when they connect to the site that matches one from the screenshot? Well, technically, they should ONLY see it the first time when creating a site before connecting.

Re: vpn-1 server could not find any certificate to use for IKE

PhoneBoy — Fri, 10 Feb 2023 02:06:46 GMT

The general fix for this issue appears to be going to Device > Certificates > Internal Certificate in the WebUI and click on Reinitialize Certificates.
That happens naturally when you factory reset the device.
I've also seen TAC cases that suggest the underlying issue may be a bug and there is a fix available.
Obviously, you can only open a TAC case if you have a support agreement (either directly or through your partner).