Hello,
I'm trying to establish a VPN between a checkpoint cluster and a fortigate device.
Checkpoint only accept cert authentication with 3rd party dynamic IP gateways.
The fortigate complains about an ID mismatch, as the checkpoint sends its IP as ID. Badfully this config is global on the checkpoint, so I can't change the setting without cutting down the other tunnels.
Here is the fortigate config :
config vpn ipsec phase1-interface edit "VPN_COL_CENTRAL" set interface "wwan" set authmethod signature set peertype any set proposal aes256-sha1 set localid "fortigate4g.mydomain" set dhgrp 2 set remote-gw 1.2.3.4 set certificate "fortigate" next end
The diag debug ike shows the following :
ike 0:VPN_COL_CENTRAL:18: peer identifier IPV4_ADDR 1.2.3.4 ike 0:VPN_COL_CENTRAL:18: Validating X.509 certificate ike 0:VPN_COL_CENTRAL:18: peer cert, subject='remotegteway.mydomain', issuer='My Root CA' ike 0:VPN_COL_CENTRAL:18: peer ID does not match cert ike 0:VPN_COL_CENTRAL:18: certificate validation failed
Does anyone know how to tell the fortigate to ignore the peer ID and accept the remote certificate ?
Best regards.
Nicolas Figaro
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Same issue here. I guess we are the only two in the world connecting Fortinet to Checkpoint in this manner because this is the only article I could find about this error. Don't suppose you solved it ? I'll dig and try to find a solution. If I find it I'll post it here.
You need to setup a peer and apply that in the cfg on the fortios
[ike 0:VPN_COL_CENTRAL:18: peer cert, subject='remotegteway.mydomain', issuer='My Root CA' ike 0:VPN_COL_CENTRAL:18: peer ID does not match cert ike 0:VPN_COL_CENTRAL:18: certificate validation failed
]
The above is telling you when validating the remote-peer, that the cert is not valid.
Checkout this in this blog I wrote
http://socpuppet.blogspot.com/2020/04/strongswan-to-forticlient-with-rsa.html
{ it's strongswan but the concept is the same }
Go down to the bottom where it explains how to do the "config user peer". I would extract the CN from the chkp certificate and set the cn value to match on that and obvious the root-CA needs to be imported into the fortios.
Go into the chkp sec-gw and look at. the IPSEC_VPN and find the internal_ca ( that's typically the default name ) and extract the details to use in the fortios device. look at the DN . It should be in a format
Subject:CN=<checkpoint_blah_blah VPN Certificate>, O=clustername
HINT: to make it easier overall, enroll and sign a csr on the checkpoint using the internal_ca < ipsec vpn , Add > and use that in the FGT. It would make life much easier. Forcepoint ( aka stonegate works pretty much the same fwiw )
Also when building the vpn-community, DO NOT set a PSK in that field. just leave it blank. You can also grab a pcap once you id the wan interface and extract the details to see what is happening if you still see failures or use ikeview
e.g
tcpdump -s0 -w ike.pcap -i eth0.199 port 500 or 4500
I hope that helps, let us know what you encounter. Maybe one day I will write a post on my blog on how to accomplish all of the above , but it's pretty much straight forward 1-2-3
Ken Felix
PCNSE
NSE
StrongSwan
Dear Ken, I export internal_ca FROM Checkpoint Trusted_CA and import to Fortinet. I saw that certificate like CA_Cert_1. I also config user peer and set CN
But I Still receive same error. See attached picture.
I didn't understand you about that, what you mean with that:
HINT: to make it easier overall, enroll and sign a csr on the checkpoint using the internal_ca < ipsec vpn , Add > and use that in the FGT. It would make life much easier. Forcepoint ( aka stonegate works pretty much the same fwiw )
As far as the steps look at the following it matches exacting what you are running into.
https://community.checkpoint.com/t5/Management/Checkpoint-to-Fortinet-VPN/m-p/13915
Keep in mind CHKP uses the ipv4_address as a AltName but the peer id used in the certificate is not matching the certificate that is why fortios is saying "in valid".
So again you need to sign the fortigate against the chkp intenal_ca. That is what I meant, use the CA authority of the CHKP to sign the CSR from the fortigate and import the signed certificate into the fortios and call up that certificate.
follow that solution document mention and you should be good and make sure you draft a CSR and import that certificate into the FGT.
Ken Felix
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1633 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.