Failed to establish S2S VPN : CRL not found & invalid certificate

[Ob1lan]

Hi,

We are trying to establish a S2S VPN connection between our main datacenter and a new Check Point firewall in another continent.

Initial setup of the new appliance went fine, it's registered with SmartConsole alright, and we can install policies and all.

But so far we failed to establish a S2S VPN connection between the datacenter and the new appliance.

Here is the errors shown in the logs, that looks related to how the new device handles/validates the certificates for the gateway to gateway authentication :

Notice we have like 30+ S2S VPN communities configured, and none are showing the same issue. We tried various combination in the encryption's settings within the community, but none helped in fixing that.

How can we troubleshoot that ? The ICA is the management server (CMA), and it's located in the datacenter as well. 

Thanks for your help !

Regards

[G_W_Albrecht]

Try sk42224: VPN tunnel establishment fails with ICA certificate first.

[Ob1lan]

Hi @G_W_Albrecht ,

Thanks but apparently that SK does not apply to us, here is what's configured in the internal_ca :

[G_W_Albrecht]

Then i would suggest IKE & VPN Debug on both sides that should reveal the details of the error. TAC could also help a lot here...

[Ob1lan · Accepted solution]

Hi @G_W_Albrecht , thanks for your input. We solved this issue. It ws the settings of the gateway, under 'Fetch Policy' that were not right.

It was set with the internal IP of the cma. Adding the externaly reachable IP, and making sure it has precedence solved the issue.