Dynamic ID error: error authenticating the dynamic identifier.

[DiegoFretes]

I get the following error in the dynamic ID when trying to log in to the VPN: “error authenticating dynamic identifier.”

My GWa is also on R81.20, as is my SMS.

Could you guide me on where I should start investigating this problem?

[israelfds95]

Please provide some more information:

Did this error start recently?
Is this error occurring only for this user?
Is this a new deployment?
Have you tried authenticating again and checked whether it worked, or if it was related to a code expiration timeout?
Have you looked for more log information in SmartConsole about this authentication attempt?

It’s also worth checking whether the symptoms match those described in the SK below:

Authentication with Dynamic ID fails with "DynamicID sending failure" error message
https://support.checkpoint.com/results/sk/sk182705

Best Regards

[DiegoFretes]

-The error started today.
-It affects all users.
-No implementation was carried out.
-When you log in with your credentials, the error sent by email pops up and the user cannot log in, nor does any code arrive.

Have you looked for more log information in SmartConsole about this authentication attempt?

I checked $FWDIR/log/vpnd.elg and found this:

SvcSk_close: refraining from closing socket -1
httpMime_destroy_db: Destroying the MIME database.
[vpnd 22594]@FW-PLANTA-02[29 Jan 10:09:54] Warning:cp_timed_blocker_handler: A handler [0x80e7720] blocked for 5 seconds.
[vpnd 22594]@FW-PLANTA-02[29 Jan 10:09:54] Warning:cp_timed_blocker_handler: Handler info: Library [vpnd], Function offset [0x9f720].
[vpnd 22594]@FW-PLANTA-02[29 Jan 10:09:54] Warning:cp_timed_blocker_handler: A handler [0xf6035d40] blocked for 5 seconds.
[vpnd 22594]@FW-PLANTA-02[29 Jan 10:09:54] Warning:cp_timed_blocker_handler: Handler info: Library [/opt/CPshrd-R81.20/lib/libmessaging.so], Function offset [0x4d40].
[vpnd 22594]@FW-PLANTA-02[29 Jan 10:09:54] Warning:cp_timed_blocker_handler: A handler [0xf5aace80] blocked for 5 seconds.
[vpnd 22594]@FW-PLANTA-02[29 Jan 10:09:54] Warning:cp_timed_blocker_handler: Handler info: Library [/opt/CPshrd-R81.20/lib/libComUtils.so], Function offset [0x1fe80].
Unable to open '/dev/fw6v0': No such file or directory

I found another difference: dynamicID works correctly in enpoint and mobile, but fails in mobile access.

[israelfds95]

If it started today and the issue only affects Mobile Access, a few more questions come up:

• Was there any change in the Mobile Access configuration?

• Was it working normally with Mobile Access before?

• How is the firewall’s CPU and memory usage?

• Was there any update applied to the firewall, such as a Jumbo Hotfix?

If it was working before and then stopped, it could be a process freeze. In this case, it’s worth restarting the cvpnd process, which is responsible for the Mobile Access blade:

cvpnstop cvpnstart

You can also review additional debugging information in sk97638 – Check Point Processes and Daemon, searching for Mobile Access.