IPSEC VPN to checkpoint with dynamic IP and certificate auth

[pkc]

Hello,

I'm trying to establish a VPN between a checkpoint cluster and a fortigate device.

Checkpoint only accept cert authentication with 3rd party dynamic IP gateways.

The fortigate complains about an ID mismatch, as the checkpoint sends its IP as ID. Badfully this config is global on the checkpoint, so I can't change the setting without cutting down the other tunnels.

Here is the fortigate config :

config vpn ipsec phase1-interface     edit "VPN_COL_CENTRAL"         set interface "wwan"         set authmethod signature         set peertype any         set proposal aes256-sha1         set localid "fortigate4g.mydomain"         set dhgrp 2         set remote-gw 1.2.3.4         set certificate "fortigate"     next end

The diag debug ike shows the following :

ike 0:VPN_COL_CENTRAL:18: peer identifier IPV4_ADDR 1.2.3.4 ike 0:VPN_COL_CENTRAL:18: Validating X.509 certificate ike 0:VPN_COL_CENTRAL:18: peer cert, subject='remotegteway.mydomain', issuer='My Root CA' ike 0:VPN_COL_CENTRAL:18: peer ID does not match cert ike 0:VPN_COL_CENTRAL:18: certificate validation failed

Does anyone know how to tell the fortigate to ignore the peer ID and accept the remote certificate ?

Best regards.

Nicolas Figaro

[jickfoo]

Same issue here. I guess we are the only two in the world connecting Fortinet to Checkpoint in this manner because this is the only article I could find about this error. Don't suppose you solved it ? I'll dig and try to find a solution. If I find it I'll post it here. 

[radebebek]

Are you resolve this?

[emnoc]

You need to setup a peer and apply that in the cfg on the fortios 

[ike 0:VPN_COL_CENTRAL:18: peer cert, subject='remotegteway.mydomain', issuer='My Root CA' ike 0:VPN_COL_CENTRAL:18: peer ID does not match cert ike 0:VPN_COL_CENTRAL:18: certificate validation failed

]

The above is telling you when validating the remote-peer, that the cert is not valid.

Checkout this in this blog I wrote 

http://socpuppet.blogspot.com/2020/04/strongswan-to-forticlient-with-rsa.html

{ it's strongswan but the concept is the same }

Go down to the bottom where it explains how to do the "config user peer". I would extract the CN from the chkp certificate and set the cn value to match on that  and obvious the root-CA needs to be imported into the fortios.

Go into the chkp sec-gw and look at. the IPSEC_VPN and find the internal_ca ( that's typically the default name ) and extract the details to use in the fortios device. look at the DN . It should be in a format 

Subject:CN=<checkpoint_blah_blah VPN Certificate>, O=clustername

HINT: to make it easier overall, enroll and sign a csr on the checkpoint using the internal_ca < ipsec vpn ,  Add > and use that in the FGT. It would make life much easier. Forcepoint ( aka stonegate works pretty much the same  fwiw ) 

Also when building the vpn-community,  DO NOT set a PSK  in that field. just leave it blank.  You can also grab a pcap once you id the wan interface and extract the details to see what is happening if you still see failures or use ikeview

e.g

  tcpdump -s0 -w ike.pcap -i eth0.199 port 500 or 4500 

I hope that helps, let us know what you encounter. Maybe one day I will write a post on my blog on how to accomplish all of the above , but it's pretty much straight forward 1-2-3 

Ken Felix

[radebebek]

Dear Ken, I export internal_ca FROM Checkpoint Trusted_CA and import to Fortinet. I saw that certificate like CA_Cert_1. I also config user peer and set CN

But I Still receive same error. See attached picture.

I didn't understand you about that, what you mean with that:

HINT: to make it easier overall, enroll and sign a csr on the checkpoint using the internal_ca < ipsec vpn ,  Add > and use that in the FGT. It would make life much easier. Forcepoint ( aka stonegate works pretty much the same  fwiw ) 

[emnoc]

As far as the steps look at the following it matches exacting what you are running into.

https://community.checkpoint.com/t5/Management/Checkpoint-to-Fortinet-VPN/m-p/13915

Keep in mind CHKP uses the ipv4_address as a AltName but the peer id used in the certificate is not matching the certificate that is why fortios is saying "in valid".

So again you need to sign the fortigate against the chkp intenal_ca. That is what I meant, use the CA authority of the CHKP to sign the CSR from the fortigate and import the signed certificate into the fortios and call up that certificate.

follow that solution document mention and you should be good and make sure you draft a CSR and import that certificate into the FGT.

Ken Felix