SAML Auth failure after upgrade to R82.10

[StevePearson]

I've been upgrading a clustered pair of 3500's running R81.10 to the new 3920's running R82.10

The management was R81.20 so I started by upgrading this to R82 with recommended JHF. It was virtual, so simply spun up a new one using migrate export/import, no problem here.

I then replaced the gateways, updated the management accordingly and pushed the policy. This was fine and everything appeared to come back up normally, including all the site to site VPN's.

Final tests were remote access, some users have user/password/certificate but most use SAML. (this has been working fine for over 12 months) The user/password/certificate users work fine but the SAML users are unable to connect. It appears that the authentication happens correctly to Azure, but the token is then not accepted by the gateway and the connection fails.

Has anyone else come across this?

[the_rock]

Regardless of the browser?

[StevePearson · Accepted solution]

Hi Andy,

I've just fixed this!

I eventually found in the logs the error "Received an assertion that is valid in the future", which led me to the time on the gateways. I found that they were not synced to the Checkpoint NTP servers, so were about 8 minutes slow! (never thought to check this as the old gateways were NTP enabled so assumed all was ok!)

More digging, I found that there was no rule to allow outbound comms from the gateways for NTP, so the old gateways, despite being configured for NTP were not actually communicating with the NTP servers. I added the relevant rule, pushed the policy and kicked the NTP daemon,  the gateways synced and the issue was resolved!

Regards,

Steve

[the_rock]

Excellent job!