Hi CheckMates guys,
Last week I helped one of our Customers with Mgmt server migration from one DC to another DC.
Instead of using traditional approach using migrate_server tool we decided to just create HA Mgmt and make full sync between them.
Because in new DC Mgmt server should have different IP we had to regenerate licenses, tune some files a little bit (eg. HKTL_registry.data), and a little more.
In the end everything worked (more or less) as expected ... besides one Site-2-Site tunnel.
It was tunnel between two Check Point's clusters managed by this Mgmt server - so in this case using PKI.
Rest of tunnels were with 3rd parties using PSK, and they worked flawlessly.
We had some issues with logs (couldn't display them) and because of that I didn't see what was the error with this s2s tunnel.
Tcpdumps, vpn debugs also didn't help here.
In the end we solved this issue - problem was with CRL distribution point - SGs couldn't reach it.
It was configuration error - these SGs are using proxy server ... and we forgot to change IP after moving SMS from one DC to another. After correction everything was fine.
And ... after this maybe too long description ... I have couple of questions to you - maybe some of you faced the same issues and have solution:
1) as far as I know if we have in IPSec configuration internal certificate (signed by ICA) and other certificate (signed by external CA) - preferred one by SGs will be this external. However if we go to IPSec VPN > Traditional mode configuration > select Public Key Signatures > Specify ... we can see "The gateway can use any of its certificates".
So it means that it can be either this one from ICA or this external one.
If I would like to force this gateway to always use for example this signed by ICA I can select option "The gateway must use a certificate issued by this Certificate Authority" and choose internal_ca.
But it will mean that for all s2s tunnels using PKI it will be that certificate - always.
My question is - is there any way to select different certificates for different VPN Communities ?
I mean that if I will have for example two VPN Communities using PKIs for authentication (each with different SGs) I want that with SG1 they should authenticate with internal certificate, and with SG2 with this external one.
2) is there any way to disable CRL verification ? I mean that connection should be possible also when CRL distribution point couldn't be reached ?
3) Last question - is there really no option to have PSK authentication between locally managed gateways ?
--
Best
Marcin
