Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
cem82
Contributor
Jump to solution

Identity Awareness collector agent and GW VPN certificate renewal

Hi

The gateway VPN certificates are coming up to expire so need to renew those.  I gather though that that is the certificate that is used for trust between the identity collector agent.  Is there anything that needs to be done on the IA Agent server as well and would there be impact for when we do the renewal on the GW in terms of identities?  We're not using third party certificate provider for this. 

0 Kudos
1 Solution

Accepted Solutions
the_rock
Legend
Legend

Normally, you would get at least one week warning, but with R81+, I believe its 60 days. There is no risk, you can easily do it in the middle of the day. I done so with customers many times before and was fine. Though, to be 100% sure, maybe better do it after normal working hours. I never even seen a single case where any VPN tunnel went down when this was done. To my recollection, there was never an issue with IA agents either.

Best,

Andy

View solution in original post

(1)
11 Replies
the_rock
Legend
Legend

Normally, you would get at least one week warning, but with R81+, I believe its 60 days. There is no risk, you can easily do it in the middle of the day. I done so with customers many times before and was fine. Though, to be 100% sure, maybe better do it after normal working hours. I never even seen a single case where any VPN tunnel went down when this was done. To my recollection, there was never an issue with IA agents either.

Best,

Andy

(1)
cem82
Contributor

Thanks for the advice and didn't have any blips for IA or need to do anything on the collector side which is great 🙂

0 Kudos
the_rock
Legend
Legend

Good to hear 🙂

Andy

0 Kudos
Sajid_Abbas
Contributor

Could you please advise on how to renew this certificate or how can i check the expiration date. The gateway is only running ID blade and not any VPN blade. The ID collector says VPN certificate so where do I view or renew on the Gateway

0 Kudos
the_rock
Legend
Legend

I was referring to vpn cert, which would be there if you are running vpn blade on the fw. If not, maybe attach a screenshot, so we can verify.

Best,

Andy

0 Kudos
cem82
Contributor

You need to temporarily enable IPSEC VPN blade, then IPSec VPN then select the cert and click renew then disable VPN blade again.  You don't need to push after enabling/disabling is just to get the VPN section in GW properties to appear.  I did have an SK showing this but can't find it at the moment but will add if I can find it

This should give the expiry date

cpca_client lscert -stat Valid -kind IKE

0 Kudos
the_rock
Legend
Legend

That for sure makes sense to me. Just doing some Azure studying now, but will check later in the lab,

Best,

Andy

0 Kudos
the_rock
Legend
Legend

@Sajid_Abbas Just tested what @cem82 said, worked exactly how he described.

Best,

Andy

0 Kudos
CheckPointerXL
Advisor
Advisor
0 Kudos
cem82
Contributor

Was a combination of these.  There was another one that said to run a tcpdump as well to see cert expiry that got me on the right track but can't locate or that SK has been updated/removed to not show that bit anymore

 

https://support.checkpoint.com/results/sk/sk113021

https://support.checkpoint.com/results/sk/sk105723

https://support.checkpoint.com/results/sk/sk97792

 

the_rock
Legend
Legend

Good job!

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events