Central management and certificate based VPNs

[velo]

I have a Star IPSEC VPN setup with all gateways managed centrally. Recently, I encountered a problem when the management server was offline for a few hours. During that time, all of the VPNs dropped when they re-keyed, even though the certificates still had years left before expiration. This behavior was unexpected and quite concerning, as it seems to present a single point of failure.

Does anyone know why this happened? I couldn't find any information about this in the documentation.

My understanding was that central management would only be an issue if a VPN certificate expired, as we wouldn't be able to generate a new certificate with the management server down.

I'm going to take a guess and assume that maybe when the VPN re-keys, it checks with the CA to see if the certificate is still valid. Is there any way around this? It's pretty bad if the management server is so critical to VPN re-keying.

[PhoneBoy · Accepted solution]

VPN certificates are validated against the CA on rekey, whether it be the internal CA or an external one (depending on configuration).
Extended outages of management when ICA is used for VPN certificates will cause VPN issues like you experienced.

Having said that, this usually doesn’t happen for about 24 hours (not just a few, as you experienced).
The CRL should be cached, in fact, and you may want to check this sk: https://support.checkpoint.com/results/sk/sk116340

You can disable CRL checking, of course, but checking the CRL is an important security feature that should not be disabled.
See: https://community.checkpoint.com/t5/General-Topics/Failure-to-fetch-updates-from-CheckPoint-servers/...

[velo]

Thank you for the response. I had a suspicion it might be something like that.

Where do I need to check the settings listed in sk116340? I can't see that section in Smart Console.

Thank you

[PhoneBoy]

In the object list, you find it under Servers > Trusted CA > internal_ca
This was taken from R82, but it should be the same in previous releases. 
I've submitted feedback on the SK to ensure instructions for finding in R8x are included.