SMB IPSec VPN Certs - Internal CA

[T_L]

Good Afternoon --

Does anyone have any scripts or scripting mojo that would allow the IPSec VPN certs to be renewed on a bunch of 1400/1500 centrally managed SMB gateways all at once?

We have a large number of SMBS (R77.20 - R81.x)  centrally managed by a physical 3150 SMS_r81.10.  All the gateways are configured in permanent tunnels utilizing the local CP internal CA on each. We have had to renew the certs manually/ individually on all of them.

The majority of the GWs are 1400 series on the R77.20 code so scripting from the SMS is a no go -- but something we could run from the local CLI - that we could could pipe to all our SSH sessions at once would work.

Thanks!

[PhoneBoy]

How are you using the ICA of the SMB device if the devices are centrally managed?
The ICA, in this case, would be on your Smart-1.

The good news is that we're about to release a script that will assist with this task.
It does require being on a specific R81.10/R81.20 JHF level at time of writing.

[Lesley]

I am not aware of a script. But the renewal takes places on the mgmt. There you renew the cert and push it out via policy push.

That is why I don't think you can run a script on the box itself.

Now the steps are not to bad, if I assume you renew it on the fw object in Smart Console and press the renew button, correct?

You can also think about to extend to cert time from 1 year to 3 year: https://support.checkpoint.com/results/sk/sk176527

This will save a bit of work until there is something new as PhoneBoy posted.

[T_L]

Yes - the ICA is used from the object on the SMS - I misspoke. My intention was to indicate there was no type of external/ 3rd party cert being utilized.

SK176527_31539 - this is the procedure used - it just takes a long time if you have you hundreds!

But I think we will be ok increasing the cert time in the SMS.

Thanks!