Disabling CRL checking for centrally managed VPNs

[Irek_Romaniuk]

I have many 1100/1400 smart provisioned, centrally managed appliances which do CRL check with management server (fw1_ica_services port)  and if check fails tunnel is dropped with default of 24h. Is there a way to disable this check i.e. sk21156 ? I don't need CRL check because if I don't want appliance to have tunnel up I will terminate the provisioned object on mgmt server. Please advice

[PhoneBoy]

I don't see why you couldn't apply the SK you referenced to solve the issue, even if you're using SmartProvisioning. 

[Irek_Romaniuk]

Correct. It's not really an issue, CRL check is default (by design) but I think it creates Denial of Service risk because the port has to be opened on public IP.

[Mike922]

Thanks, killing the CRL check solved my problem. My management server is nat'd behind a firewall on a large private secondary network.   Support was sending me down the path of disabling all of my implied rules. That was not going to happen.