R81.20 IPsec VPN certificate repository.

[RPawar]

We have an upcoming migration in place from CP 5600 to CP - Maestro 140.

The Maestro fabric has 2 QF 9000 apliances in a single security group and this is a single site deployment.

This will be a direct migration where maestro SG will inherit the IPschema of live 5600 GW as is.

The management server is also same so object and rules will also be same along with VPN community.

Now my query is that as i have checked the live 5600 GW Object under IPsec VPN setting i can see that there is certificate repositary which is available for the live gateways it has one defaultcert and 2 differnt certs which is being used for a DAIP VPN.

When i check maestro repository i only see one defaultcert and not the other certificates.

Please note maestro is not yet added in the VPN communities and i am assuming that once i add maestro in the VPN community and the push policy on  maestro then the certificates will be visible for maestro as well.

Kindly go through and assist with some documentation to solve this.

[PhoneBoy]

Internal Certificate Authority certificates will be generated and applied automatically.
If an external CA is used (if you have more than one certificate there, you probably are), you will need to add a new certificate, which will generate a CSR that needs to be signed by the CA.

[RPawar]

Hello PhoneBoy,

Thanks for your inputs as you mentioned I have generated a new CSR and also got it signed from our CA (in this case it was our Microsoft Team), Everything was proper I uploaded the certificate and completed the CSR process however in the existing gateway the certificate has live WAN virtual IP in it under SAN and in the certificate that i generated for new GW doesn't have the IP in it. Just want to know if we migrate at this point will the DAIP VPN renegotiate automatically with new GW as the certificate has same DN details and Issuer details on the new certificate. Only thing that's missing is the Subject Alternative Name "IP Address : Live WAN-VIP"

I need clarification on this point as this is a critical migration, and your help is highly appreciated.

[the_rock]

Im sure Phoneboy will confirm, but to me, logically, does not sound that would work at all, if right IP is not listed.

Andy

[RPawar]

Hello the_rock,

This is exactly what I thaught but i do have one more query as to why did the signed certificate did not have the WAN IP in it ? As while generating the CSR i have selected the same trusted CA server which is used for live gateways and also have replicated the same DN details into it, is it possible that due to WAN interfaces was physically disabled on maestro due to that the CSR was not able to pull the IP details into it? or could it be that while signing the certificate we have to mention the SAN details explicitly not sure about this.

[the_rock]

Im not expert by any means when it comes to certificates (never was), but to me, sounds like there could be 2 reasons:

1) CSR did not include the right IP

2) SAN must be defined 

Andy

[PhoneBoy · Accepted solution]

The whole point of DAIP is not to be tied to an IP.
Which means the SAN does not need to include the IP as it will necessarily change...because DAIP.

[RPawar]

Hello PhoneBoy,

I completely agree with your point but in this case the peer Gateway will be having dynamic IP and the local GW (live DC 5600 cluster) has a single WAN IP. The certificate that is being uploaded on both end Peer and Local is signed by same Trusted CA 

[PhoneBoy]

Even so, the (lack of) SAN IP hasn't presented an issue that I'm aware of.
If you want 100% confirmation, check with TAC.

[RPawar]

Hello ALL,

Just want to clarify and update on this case

The SAN does matter as when we generated the new csr got it signed and uploaded on both gateways (Peer and Local) the tunnel was not coming up.
On further troubleshooting i cam across one particular step while generating new CSR which is when we enter the CN details there is a checkbox of "Alternative Name" when i clicked it it opened a new popup where we can ADD tha SAN details ourselves with FQDN & IP, based on my requirement i selected IP and added my WAN IP and the generated the CSR now once it gets signed i will complete the certificate procedure and then upload the new certificate on the peer device as well post this i think the issue should get resolved.

However, i would like to highlight that this setting and configuration is not at all mentioned in any documentation that Check Point provides on their website which is weird as to why they would not highlight such a critical part in regards to certificates.

[the_rock]

Thanks for the update!

[PhoneBoy]

The FQDN definitely needs to be there.
What I was questioning was the IP, which is going to change in a DAIP configuration.

[RPawar]

Hello PhoneBoy,

the IP will change but only on peer end

on local GW the IP will remain same and it will be the WAN ip not the fqdn (in my case) 

So how it works is the peer will have same certificate on their DAIP devices where they will know exactly which IP to reach out to for tunnel key installation.

Above is my assumption, please feel free to correct if any thing wrong.

PS: the issue got solved and tunnels are up now.