Error Remote Access Connection R77.30

[andrey247]

Hello!

An error occurred while connecting to RA via the Checkpoint endpoint client("Error connecting to the site."). A gateway reboot was performed, but the problem recurred a day later. Renewing the certificate finally resolved the issue. The old certificate was still active. Please explain what this error might be related to and what steps are needed to prevent it.

I found the following messages in the vpnd.elf file

get_dpd_initiator_peers_hash: peer X.X.X.X. doesn't appear in dpd_initiator_peers hash
fwCert_FindCertreqList: Entering
Reactor::poll: received event for RID 2695
wCert_FindCertreqList: I have no certificate to use for IKE.
fwCert_FindCertreqList: no cert request has been prepared
MMCreate4: can't create cert request

[Vincent_Bacher]

I hope you don’t take this the wrong way, but I wanted to point out that R77.30 has been end-of-life for over five years now. Because of this, I don’t think it makes much sense to discuss troubleshooting or solutions for such an outdated release, especially given the security and support implications.

I strongly recommend upgrading to a currently supported version as soon as possible. Once you’ve done that, I’d be more than happy to help with any issues or questions you might have!

Thanks for your understanding.

[andrey247]

I understand, but unfortunately there is no way to update to a newer version

[_Val_]

That's just too bad. I would also like to stress what @Vincent_Bacher mentioned above: trying to fix an issue with a version out of support for years is absolutely futile.

[Vincent_Bacher]

What's the reason that there is no way?
In Germany we say "Geht nicht, gibt's nicht" meaning there is no way to say there is no way, there is always a way.

[TurgutKaplanogl · Accepted solution]

Hello,

Such issues may occur after certificate renewal operations. It appears that the initial problem you experienced was caused by the certificate having expired. This condition can be observed during policy installation or while checking logs.

Following this after the certificate renewal it is necessary to verify that the certificate has been properly updated after performing a policy install. For this verification for example if MOB VPN is being used, you should be able to see the new certificate via a web browser. If a VPN client is used, you can check the certificate of the configured site or as a simple test you may delete and recreate the site(for showing new certificate).

I am aware that similar situations have been encountered before. After such certificate changes, waiting for a period of time or performing actions such as service restarts can help shorten the fix. For instance, a similar issue was experienced and resolved even in the SK R81.20 version, which I will share below.

https://support.checkpoint.com/results/sk/sk183123

Additionally, I recommend upgrading to the recommended and supported version.

Thank you

TK

[the_rock]

Put it this way...the fact it still works, you are very lucky, specially considering you are using totally unsupported version. Other than making sure cert is valid (as far as the date goes), not much else really to check.

[PhoneBoy]

If you cannot upgrade from R77.30 for whatever reason, please ensure you have at least this hotfix installed: https://support.checkpoint.com/results/sk/sk182336 

[andrey247]

Thanks everyone for your help! I have a similar issue to this sk https://support.checkpoint.com/results/sk/sk183123