I’m not sure if what i am doing below is correct? i am still trying to lab it before asking customer to do it. If you have step by step, could you share with about that?
Much respect to anyone who has adopted this configuration and shared it with me. Is it necessary to use User login and AD user? or any user is fine?
I have created a CA named mtech-lab.local and created a Trust Server CA on Check Point.
![TronNQ_0-1722523499727.png TronNQ_0-1722523499727.png](https://community.checkpoint.com/t5/image/serverpage/image-id/27073i835ACC3D90B39BA9/image-size/medium?v=v2&px=400)
Next, I go to IPsec in Object GW and create an enroll cert, then put it in CA issue and complete on GW.
![TronNQ_1-1722523499732.png TronNQ_1-1722523499732.png](https://community.checkpoint.com/t5/image/serverpage/image-id/27070iD68CE9AF6DDD971C/image-size/medium?v=v2&px=400)
I have installed the machine and CA certificates on the local machine and in the Personal & Trusted Root Certification Authorities folders.
![TronNQ_2-1722523499736.png](/skins/images/7315878AF3974001208AFA0DEDE3F170/responsive_peak/images/image_not_found.png)
Next, I enabled cert authen and created a policy. I use local user created on Check Point to authenticate VPN and machine is on AD.
![TronNQ_3-1722523499737.png](/skins/images/7315878AF3974001208AFA0DEDE3F170/responsive_peak/images/image_not_found.png)
![TronNQ_4-1722523499738.png](/skins/images/7315878AF3974001208AFA0DEDE3F170/responsive_peak/images/image_not_found.png)
As a result, when VPN we still cannot connect to internal resources. When we switch Auhen Machine to Mandatory and VPN, we get an error message "Machine Certificate Is Required". This means that the Import Cert is still incorrect.