Help a Newbie Connect to a Checkpoint box

[msetto]

I am trying to get VaporSec to connect to a Checkpoint NG AI gateway using x.509 certificates. I have successfully connected using Checkpoints SecuRemote on a windows machine as well as VPN Tracker on my Mac running 10.3.2, the same machine I am trying to get VaporSec running on. When setting up the connection in Tracker I am setting the connection type to “Check Point (Certificates)”. I have tried to duplicate the settings in VaporSec but the only thing I can’t seem to comprehend is how to supply a password for the cert. I have added the p12 cert to both my “login” and “system” keychains. Using Tracker’s Document “HowTo_CheckPoint_Rev_1.1.pdf” as a reference it instructs me to import the certificate, while importing I am prompted for a password, I am not sure where to put this password in VaporSec or does it use the keychain. I have tried to put it in the “Shared Secret” but that doesn’t seem to work either. When i Vaporize the connection I get in the system.log:

Jan  3 23:52:00 localhost racoon: ERROR: isakmp.c:2033:
isakmp_chkph1there(): phase2 negotiation failed due to time up waiting for phase1. ESP FIREWALLIP->192.168.5.102

When I do a tcpdump I get this:

22:06:08.877745 192.168.5.102.isakmp > 44.333.222.111.myisp.com.isakmp: isakmp: phase 1 I ident: [|sa]
22:06:08.990658 44.333.222.111.myisp.com.isakmp > 192.168.5.102.isakmp: isakmp: phase 1 R inf:
    (n: doi=0 proto=1 type=NO-PROPOSAL-CHOSEN)

What does “NO-PROPOSAL-CHOSEN” mean?

So I am not sure if it is an issue with not supplying the password or some other problem. Any help or direction is appreciated. Thank you.

-mike

[msetto]

Well i got the VPN tunnel built, but not with VaporSEC. First of all you can’t use p12 formated certificates. I had to convert it to .pem format and extract my cert and key. Then I had to remove the password from the key. I put them in /etc/cert the default for racoon not VaporSEC, added verfy_cert off and change authentication_method rsasig (could not do that in VS without having certs on both sides)

Part of my conf file looks like this:

remote xxx.yyy.zzz.123
{
exchange_mode main;
my_identifier asn1dn;
certificate_type x509 “cert.pem” “npkey.pem”;
verify_cert off;
nonce_size 16;
lifetime time 1440 min; # sec,min,hour
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method rsasig ;
dh_group 2 ;
}
}

sainfo address 192.168.2.1/32 any address 192.168.1.0/24 any
{
lifetime time 3600 sec;
encryption_algorithm aes, 3des ;
authentication_algorithm hmac_sha1;
compression_algorithm deflate ;
}

I created a script to do everything and it’s working great. I also noticed that VS wants to copy the certs to one location and the conf file specifies another sorry i can’t remember the location right now i uninstalled a few weeks ago. I hope this helps someone else and look forward to the next version of your software. Thank you making it available without it i would have never of figure this out.

~mike

[Author]

Posts