Disabling CRL checking for centrally managed VPNs

[Irek_Romaniuk]

I have many 1100/1400 smart provisioned, centrally managed appliances which do CRL check with management server (fw1_ica_services port)  and if check fails tunnel is dropped with default of 24h. Is there a way to disable this check i.e. sk21156 ? I don't need CRL check because if I don't want appliance to have tunnel up I will terminate the provisioned object on mgmt server. Please advice

[PhoneBoy]

I don't see why you couldn't apply the SK you referenced to solve the issue, even if you're using SmartProvisioning. 

[Irek_Romaniuk]

Correct. It's not really an issue, CRL check is default (by design) but I think it creates Denial of Service risk because the port has to be opened on public IP.

[Mike922]

Thanks, killing the CRL check solved my problem. My management server is nat'd behind a firewall on a large private secondary network.   Support was sending me down the path of disabling all of my implied rules. That was not going to happen. 

[stat4299]

Is anyone aware of an emergency procedure to disable this check on the gateways only?  Say the primary and secondary management is down (assuming there is even a secondary).  It would be great to have a way to disable the check on the gateway itself without deploying policy.  This would allow the use of CRL check but just in case of that 1 big disaster that takes out  management and it isn't recovered in 24 hours, you can keep your other gateways communicating through their managed VPN (certificates only work for that).

[_Val_]

You can disable CRL verification for VPNs on the management side, but I do not think there is a way to do that on the GW side, let alone on SBM appliances. 

[Timothy_Hall · Accepted solution]

I think the following will work on the gateway, see here

cpprod_util CPPROD_SetValue "CPshared//6.0//reserved//libCurl" crl_disable 1 1 1

[patones1]

Hello Timothy

I used the command you shared in order to disabling CRL checking with success.
The  CRL checking was preventing to work a VPN tunnel between to Check Point CAs (SMSs). The link to the issue bellow:

https://community.checkpoint.com/t5/Security-Gateways/R82-Site-to-site-VPN-authentication-issue-when...

Thanks for your help

Miguel