Skip to main content
pkc
pkc
New Member
January 31, 2017
Question

IPSEC VPN to checkpoint with dynamic IP and certificate auth

  • January 31, 2017
  • 2 replies
  • 14896 views

Hello,

 

I'm trying to establish a VPN between a checkpoint cluster and a fortigate device.

 

Checkpoint only accept cert authentication with 3rd party dynamic IP gateways.

 

The fortigate complains about an ID mismatch, as the checkpoint sends its IP as ID. Badfully this config is global on the checkpoint, so I can't change the setting without cutting down the other tunnels.

 

Here is the fortigate config :

config vpn ipsec phase1-interface     edit "VPN_COL_CENTRAL"         set interface "wwan"         set authmethod signature         set peertype any         set proposal aes256-sha1         set localid "fortigate4g.mydomain"         set dhgrp 2         set remote-gw 1.2.3.4         set certificate "fortigate"     next end

The diag debug ike shows the following :

ike 0:VPN_COL_CENTRAL:18: peer identifier IPV4_ADDR 1.2.3.4 ike 0:VPN_COL_CENTRAL:18: Validating X.509 certificate ike 0:VPN_COL_CENTRAL:18: peer cert, subject='remotegteway.mydomain', issuer='My Root CA' ike 0:VPN_COL_CENTRAL:18: peer ID does not match cert ike 0:VPN_COL_CENTRAL:18: certificate validation failed

Does anyone know how to tell the fortigate to ignore the peer ID and accept the remote certificate ?

 

Best regards.

 

Nicolas Figaro

    2 replies

    jickfoo
    jickfoo
    New Member
    August 1, 2018

    Same issue here. I guess we are the only two in the world connecting Fortinet to Checkpoint in this manner because this is the only article I could find about this error. Don't suppose you solved it ? I'll dig and try to find a solution. If I find it I'll post it here. 

    radebebek
    radebebek
    New Member
    September 29, 2021
    Are you resolve this?
    emnoc
    emnoc
    New Member
    September 30, 2021

    You need to setup a peer and apply that in the cfg on the fortios 

     

    [ike 0:VPN_COL_CENTRAL:18: peer cert, subject='remotegteway.mydomain', issuer='My Root CA' ike 0:VPN_COL_CENTRAL:18: peer ID does not match cert ike 0:VPN_COL_CENTRAL:18: certificate validation failed

    ]

     

    The above is telling you when validating the remote-peer, that the cert is not valid.

     

    Checkout this in this blog I wrote 

    http://socpuppet.blogspot.com/2020/04/strongswan-to-forticlient-with-rsa.html

    { it's strongswan but the concept is the same }

     

    Go down to the bottom where it explains how to do the "config user peer". I would extract the CN from the chkp certificate and set the cn value to match on that  and obvious the root-CA needs to be imported into the fortios.

     

    Go into the chkp sec-gw and look at. the IPSEC_VPN and find the internal_ca ( that's typically the default name ) and extract the details to use in the fortios device. look at the DN . It should be in a format 

     

    Subject:CN=<checkpoint_blah_blah VPN Certificate>, O=clustername

     

     

    HINT: to make it easier overall, enroll and sign a csr on the checkpoint using the internal_ca < ipsec vpn ,  Add > and use that in the FGT. It would make life much easier. Forcepoint ( aka stonegate works pretty much the same  fwiw ) 

     

    Also when building the vpn-community,  DO NOT set a PSK  in that field. just leave it blank.  You can also grab a pcap once you id the wan interface and extract the details to see what is happening if you still see failures or use ikeview

     

    e.g

     

      tcpdump -s0 -w ike.pcap -i eth0.199 port 500 or 4500 

     

    I hope that helps, let us know what you encounter. Maybe one day I will write a post on my blog on how to accomplish all of the above , but it's pretty much straight forward 1-2-3 

     

    Ken Felix

     

     

     

     

     

    radebebek
    radebebek
    New Member
    September 30, 2021

    Dear Ken, I export internal_ca FROM Checkpoint Trusted_CA and import to Fortinet. I saw that certificate like CA_Cert_1. I also config user peer and set CN

    But I Still receive same error. See attached picture.

    I didn't understand you about that, what you mean with that:

    HINT: to make it easier overall, enroll and sign a csr on the checkpoint using the internal_ca < ipsec vpn ,  Add > and use that in the FGT. It would make life much easier. Forcepoint ( aka stonegate works pretty much the same  fwiw ) 

     

    Terms & ConditionsAccessibility statement