Skip to main content
sandyzzz
sandyzzz
Explorer
February 21, 2025
Question

FrotiManager - Pushing default VPN Certificate to Fortigate makes existing tunnel down

  • February 21, 2025
  • 3 replies
  • 1112 views

Hi All,

 

I have a ADVPN setup with certificate authentication. In firewall, we imported one local CA & root CA_1. IF any policy related changes pushed via Fortimanager to Fortigate, additionally VPN CA certificate also pushed to firewall along the policy change... so inthe firewall, we have 2 root CA's - root ca_1 & root CA_2. 

When the tunnel starts renegotiation, it takes the root CA_2 for cert authentication which caused "VPN certificate check failed " error and tunnel goes down.

 

solution: i manually deleted the root ca_@ in the firewall and tunnel came up - it works..

 

Query: i need to know what is this behavior and how to stop pushing vpn ca certificate to be pushed to firewall in fortimanager. or any other solution for this.. 

 

3 replies

Stephen_G
Staff & Editor
Stephen_G
Staff & Editor
February 23, 2025

Hello,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Stephen_G - Fortinet Community Team
Stephen_G
Staff & Editor
Stephen_G
Staff & Editor
February 26, 2025

Hi sandyzzz,

 

We are still trying to get an answer to your query. We'll respond shortly.

Stephen_G - Fortinet Community Team
    Stephen_G
    Staff & Editor
    Stephen_G
    Staff & Editor
    March 4, 2025

    Hi sandyzzz,

     

    Let me know if these steps help:

    1. Identify the Source of the CA Certificate: Check the FortiManager configuration to identify where the unwanted CA certificate (root ca_2) is being referenced or included in the policy package.
    2. Modify the Policy Package: Navigate to the Policy & Objects section in FortiManager.
      Review the policy package and ensure that only the desired CA certificates are included.
      Remove any references to the unwanted CA certificate (root ca_2) from the policy package.
    3. Disable Automatic CA Certificate Push:
      If FortiManager is configured to automatically push CA certificates, you may need to adjust the settings to prevent this.
      Go to the Advanced Options in the Policy & Objects section and ensure that the automatic push of CA certificates is disabled or configured correctly.
    4. Re-Issue Certificates: If necessary, re-issue the correct VPN certificates to ensure that the FortiGate uses the correct CA certificate for authentication.
    5. Test the Configuration: After making the changes, test the VPN tunnel to ensure that it uses the correct CA certificate and that the tunnel remains stable.
    6. Monitor for Future Changes: Regularly monitor the FortiManager and FortiGate configurations to ensure that no unwanted changes are made that could reintroduce the issue. By following these steps, you should be able to prevent the unwanted CA certificate from being pushed to the FortiGate and ensure stable VPN tunnel operation.
    Stephen_G - Fortinet Community Team
    Terms & ConditionsAccessibility statement
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.