ICA change IP to FQDN

[BrianHansen]

Hello,

I have a customer who would like to change the ICA certificate from containing the SmartCenter IP address to the SmartCenter FQDN.

I have explained that changing the ICA certificate involves additional tasks, such as re-establishing SIC and updating VPN clients, but the customer is aware of this and accepts it.

I am unable to find a procedure for this, has anyone completed such a change successfully and is it supported ?

Best Regards

Brian Hansen

[the_rock]

Hey Brian,

Im fairly sure you can do this, BUT, catch is you would need to re-initialize ica from cpconfig on mgmt, then reset sic, as sic would be broken to all gateways managed by it.

[alisson-lima]

Hey Brian,

In addition to Andy's comments, I am not sure if you can replace the IP for a FQDN. Is there any security compliance to do it?

I recommend you to read the R81.20 admin guide for management server. There is a command cp_conf ca that allows you to add the FQDN, I'd test it in lab first.

cp_conf ca

Alisson Lima
CCSM Elite

[the_rock]

That should work:

[Expert@CP-MANAGEMENT:0]# cp_conf ca

Usage:
cp_conf ca init # Initializes Internal CA
cp_conf ca fqdn <name> # Sets the name of the Internal CA
[Expert@CP-MANAGEMENT:0]#

[BrianHansen]

Hello Andy,

Thank you for replying.

I do not think this will fix my issue. The issue is that the Commonname (CN) of the certificate contains the IP address of the ICA (by default). The command cp_conf ca fqdn <name>, will do the following:
The Management Server uses the specified "<FQDN Name>" to configure the Certificate Revocation List Distribution Point (CRL DP) property in all certificates that the ICA generates.

• The existing certificates for configured objects are not revoked.

• The existing ICA certificate is not changed.

Best Regards

Brian Hansen

[the_rock]

k, fair enough.

[emmap]

ICA is already based on FQDN by default. It's why you can change the IP of your management server without resetting SIC (if you do it right).

Do you not have the FQDN in yours?

[the_rock]

Thats true...changing IP would definitely not break SIC.

[BrianHansen]

Hello Emma,

Thank you for replying.

I do not fully understand, what you mean by the ICA is based on FQDN by default. When I check the certificate, the CN is based on the IP of the SmartCenter, by default.

SIC continues to work after SMC IP change, but AutoRenewal of the Certificate will fail, as that is also IP based.

sk103356:

IP Address of the Internal Certificate Authority (ICA) of Security Management Server / Domain Management Server is automatically added to Check Point Registry file ($CPDIR/registry/HKLM_registry.data) on Security Gateway when SIC is first established (between Security Gateway and Management Server).

If the IP Address of a Security Management Server / Domain Management Server is changed, and SIC is never manually reset (between a Security Gateway and a Management Server), then the AutoRenewal of the Certificate will fail.

[the_rock]

Hey Brian,

Happy weekend!

Please let us know how this process goes.

[BrianHansen · Accepted solution]

Hello Andy,

It has turned out the the main issue, was related to the SmartCenter and gateways web certificates, so the plan is to replace these with a certificate signed by the internal CA.

Thank you for all replies.

Best Regards

Brian Hansen 

[the_rock]

Glad you got it.