File sdconf.rec in VSX Gateway Cluster

[jennyado]

Hello everyone,

I am opening this thread because I have a question regarding an ongoing activity. I need to migrate a VSX Cluster in Load Sharing mode from a 6700 model to a 9700 model. I already have a defined process and all the necessary information for the migration.

The customer uses VPN RA with RSA authentication, so we know that the following files need to be transferred from the old system to the new one:

/var/ace/sdopts.rec
/var/ace/sdconf.rec

However, during our review, we noticed that in Virtual System 1 of the old appliances, the following file also exists:

/var/opt/CPsuite-R81.20/fw1/CTX/CTX00001/conf/ace/sdconf.rec

While testing in the lab and running the vsx_util reconfigure command, we observed that the path:

/var/opt/CPsuite-R81.20/fw1/CTX/CTX00001/conf/ace/

is not generated on the new appliances, even though it exists in the previous environment.

My question is whether this /ace directory inside /conf in Virtual System 1 needs to be created manually, if it is automatically generated when configuring RSA users, or if there is a specific procedure to create it (for example, by reconfiguring or re-implementing RSA).

If anyone has experienced something similar or can provide guidance, I would greatly appreciate your input.

Best regards.

[PhoneBoy]

I don't see any harm in recreating it manually, though I'm curious why it's necessary to.

[jennyado]

Due to the ongoing migration of the configuration to the new firewalls, we identified this file under VS1 and would like to confirm whether it needs to be manually replicated to the new VS1 or if it is automatically generated by the system.

We would like to ensure that the new environment is fully aligned with the current configuration and that no required components are missed during the migration process.

[Lesley]

Check if the file is already in VS0, if so you can copy it to VS1 VS2 etc 

/var/ace/sdconf.rec

https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_VSX_AdminGuide/Content/Topic...

NOTE: if you upgrade to R82.10 the directory will change: 

/var/opt/CPsuite-R82.10/fw1/CTX/CTX00001/conf/ace/sdconf.rec

[jennyado]

We have completed the migration; however, we had to temporarily disable RSA authentication for the VPN c2s because users were receiving the following errors:

• SecurID configuration problem

• SecurID request failed

The current RSA files are as follows:

VS0

• /var/ace/sdopts.rec

• /var/ace/sdconf.rec

VS1

• /var/opt/CPsuite-R81.20/fw1/CTX/CTX00001/conf/ace/sdconf.rec

• /var/opt/CPsuite-R81.20/fw1/CTX/CTX00001/conf/ace/sdopts.rec

As part of the troubleshooting with Check Point TAC, the RSA administrator regenerated the sdconf.rec file, but the issue persisted.

At the moment, RSA authentication remains disabled. I wanted to check whether anyone has encountered this issue before or has any idea what else might be missing.

So far, we have verified the following:

• Connectivity to the RSA server.

• The sdconf.rec and sdopts.rec files are located in the correct directories.

• The sdconf.rec file was regenerated by the RSA administrator.

Our next step is to collect debug logs, but before doing so, I wanted to ask if anyone has experienced a similar issue or has any recommendations on additional items to verify.

[emmap]

It's been a long time since I had to use this, but my old notes say that I just followed the instructions here under RSA SecurID Authentication.

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_VSX_AdminGuide/Content/Topics-VSXG...

I have a dim dusty recollection of the 'Shared' tick box in SmartConsole tripping me up that's mentioned in there.

[Martijn]

Hi,

Long time since I configured Check Point with a RSA solution, but in the past I have experienced an issue with VSX and RSA and NAT.

The request from the VS was send to the RSA server with the IP of the Internal Communication Network and not with the real-world IP of the VS. We had to create a NAT rule to make it work.

And as @emmap  mentions. Check if you have configured shared or private configuration on the VSX object.

Regards,
Martijn