Over three decades of Information Technology experience, specializing in High Performance Networks, Security Architecture, E-Commerce Engineering, Data Center Design, Implementation and Support
Analysis of httpS Encryption with SSL/TSL Inspection
HTTPS and SSL
SSL based HTTPS is widely implement to secure communication. However, SSL can hide illegal user activity and malicious traffic. The SSL protocol is widely implemented in public resources that include: banking, web mail, user forums,and corporate web resources. SSL secures communication between internet browser clients and web servers. It also supplies data privacy and integrity by encrypting the traffic, based on standard encryption ciphers.
However, SSL has a potential security gap. It can hide illegal user activity and malicious traffic from the content inspection of Security Gateways. One example of a threat is when an employee uses HTTPS (SSL based) to connect from the corporate network to internet web servers. Security Gateways without HTTPS Inspection are unaware of the content passed through the SSL encrypted tunnel. This makes the company vulnerable to security attacks and sensitive data leakage
For HTTPS traffic inspection encrypted data is:
Intercepted by the Security Gateway and decrypted
Inspected by the blades set in the policy
Encrypted again and sent to the designated web server
You can enable HTTPS traffic inspection on Security Gateways to prevent security risks related to the
Secure Sockets Layer (SSL) protocol.
When a client computer initiates an HTTPS connection to a secure site, the Security Gateway:
Intercepts the request.
Establishes a secure connection (an SSL tunnel) to the requested website and validates the site's server certificate
Creates a new SSL certificate for the communication between the Security Gateway and the client, sends the client the new certificate and establishes a different SSL tunnel with it
Using the two tunnels:
It decrypts the encrypted data from the client.
Inspects the clear text content for all blades set in the policy.
Encrypts the data again to keep client privacy as the data travels to the destination web server
resource.
The signature
Check Point IPS Update Service produces new protections to protect against emerging exploits and vulnerabilities to help security administrators stay continuously ahead of today's constantly evolving threat landscape.
Here are some references to HTTPS Inspection. Plus sk108202 has a whole section on additional references. We made significate enhancements in R77.30 with HTTPS Inspection. Application Control and URL Filtering R77 Versions Administration Guide – (how to configure HTTPS Inspection)
TRUST / SSL handshake Client/webserver TRUSTED CA Store
Impersonate without private.key and Certificate
Gateway certificate MUST be ADDED to the browser TRUSTED STORE
How SSL is use by browser
the cllient goes to httpS://www.facebook.com
The browser is using httpS the S denotes the http session is encrypted with SSL
The first function of SSL is to establish TRUST with the site.
The browser TRUST a webserver if the server has a digital certificate that was issued by a trusted Certificate Authority =CA. That is vetting the site's identity
The SSL handshake starts off with the webserver sending its SSL Certificate to the client browser
Facebook webserver needs a way to prove it is the rightful owner of the certificate.
Facebook has a file call the private.key with is cryptographicallyprepared with its certificate
Without the possession of facebook's the private.key no one can forge a certificate to impersonate a its sight on the web. This is a key part of SSL
Facebook certificate is sign by a CA named Verisign
Our browser searches for Versign Certificate in its store of TRUSTED CA certificates.
In windows, the list of TRUSTED CAs is maintained by Microsoft
In our example the Versign certificate is found in the trusted store
so the browser decided to TRUST Facebook Certificate.
Now that the SSL cryptographically validation is done and the browser trust the website
Browsing commencing using SSL crypted communication.
Let’s visit Facebook again but now we are turning on Checkpoint SSL inspection
Do this from the https Inspection page on the SmartDashbpard
The first step for SSL inspection is to create a CA certificate to be used by the gateway for signing
We provide a certificate Name, validation date and a password that will protect the private.key
We then enable HTTPS inspection
Now let’s visit https//wwww.facebook.com again and see what happens this time
The gateway sees the browser's SSL request
Rather than letting the request thru, (Hold Request), and initiates its own SSL Session with Facebook pretending to be our browser like the browser, the gateway has its own TRUSTED CA Store which is used to Validate Facebook certificate.
This validate is critical in order to preserve the trust validation that is normally carried out by the browser.
Once the connection between the gateway and Facebook is established, the gateway creates an SSL certificate which is similar to that of Facebook
This certificate has its own private key associate with it
The gateway signs the copied certificate with its CA certificate which was created for the gateway.
Now the gateway completed the SSL session with our browser pretending to be Facebook and using the now just created certificate
But just wait, the certificate the gateway generated for Facebook was not signed by the CA that the browser TRUST.
It was signed by the Certificate were created a moment ago. The browser WARNS the browser that the certificate is NOT valid. One more KEY step must happen before the gateway can perform SSL inspection without generate a warming in our browser.
That is our gateway certificate MUST be ADDED to the browser TRUSTED STORE
to accomplish this, we export the gateway CA store file (that’s the second step we omitted before)
The imported it manually to the PC Browser trusted store
You can automatically distribute the Gateway CA by using Microsoft Group policy object in Microsoft Active Directory (AD)
From this point on, the browser TRUST Certificates generated by the gateway and it will trust the one generated for Facebook
At this point the gateway has established SSL connection between FACEBOOK and our browser acting BRIDGE between the two
This way, the gateway can inspect the content of the SSL Traffic
EXAMPLE
DLP
USE HTTPS Inspection Policy to exclude traffic for on-line banking and health sight to prevent
HTTPS Inspection
You can enable HTTPS traffic inspection on Security Gateways to inspect traffic that is encrypted by the Secure Sockets Layer (SSL) protocol. SSL secures communication between internet browser clients and web servers. It supplies data privacy and integrity by encrypting the traffic, based on standard encryption ciphers.
However, SSL has a potential security gap. It can hide illegal user activity and malicious traffic from the content inspection of Security Gateways. One example of a threat is when an employee uses HTTPS (SSL based) to connect from the corporate network to internet web servers. Security Gateways without HTTPS Inspection are unaware of the content passed through the SSL encrypted tunnel. This makes the company vulnerable to security attacks and sensitive data leakage.
The SSL protocol is widely implemented in public resources that include: banking, web mail, user forums, and corporate web resources.
There are two types of HTTPS inspection:
Inbound HTTPS inspection - To protect internal servers from malicious requests originating from the internet or an external network.
Outbound HTTPS inspection - To protect an organization from malicious traffic being sent by an internal client to a destination outside of the organization.
The Security Gateway acts as an intermediary between the client computer and the secure web site. The Security Gateway behaves as the client with the server and as the server with the client using certificates.
All data is kept private in HTTPS Inspection logs. This is controlled by administrator permissions. Only administrators with HTTPS Inspection permissions can see all the fields in a log. Without these permissions, some data is hidden.
How it Operates
In outbound HTTPS inspection, when a client in the organization initiates an HTTPS connection to a secure site, the Security Gateway:
Intercepts the request.
Establishes a secure connection to the requested web site and validates the site server certificate.
Creates a new SSL certificate for the communication between the Security Gateway and the client, sends the client the new certificate and continues the SSL negotiation with it.
Using the two SSL connections:
It decrypts the encrypted data from the client.
Inspects the clear text content for all blades set in the Policy.
Encrypts the data again to keep client privacy as the data travels to the destination web server resource.
In inbound HTTPS inspection, when a client outside of the organization initiates an HTTPS connection to a server behind the organization's gateway, the Security Gateway:
Intercepts the request.
Uses the server's original certificate and private key to initiate an SSL connection with the client.
Creates and establishes a new SSL connection with the web server.
Using the two SSL connections:
It decrypts the encrypted data from the client.
Inspects the clear text content for all blades set in the policy.
Encrypts the data again to keep client privacy as the data travels to the destination server behind the gateway.
Configuring Outbound HTTPS Inspection
To enable outbound HTTPS traffic inspection, you must do these steps:
Set the Security Gateway for HTTPS Inspection.
Generate a CA certificate on the Security Management Server or import a CA certificate already deployed in your organization.
If you created a CA certificate, you must deploy it in the Trusted Root Certification Authorities Certificate Store on the client computers. This lets the client computers trust all certificates signed by this certificate.
Generate an HTTPS inspection policy by defining relevant rules in the HTTPS inspection Rule Base.
Configure the conditions for dropping traffic from a web site server.
When required, you can update the trusted CA list in the Security Gateway.
Enabling HTTPS Inspection
You must enable HTTPS inspection on each Security Gateway. From Security Gateway > HTTPS Inspection > Step 3 > Select Enable HTTPS Inspection.
The first time you enable HTTPS inspection on one of the Security Gateways, you must create an outbound CA certificate for HTTPS inspection or import a CA certificate already deployed in your organization. This outbound certificate is used by all Security Gateways managed on the Security Management Server.
Creating an Outbound CA Certificate
The outbound CA certificate is saved with a P12 file extension and uses a password to encrypt the private key of the file. The Security Gateways use this password to sign certificates for the sites accessed. You must keep the password as it also used by other Security Management Servers that import the CA certificate to decrypt the file.
After you create an outbound CA certificate, you must export it so it can be distributed to clients. If you do not deploy the generated outbound CA certificate on clients, users will receive SSL error messages in their browsers when connecting to HTTPS sites. You can configure a troubleshooting option that logs such connections.
After you create the outbound CA certificate, a certificate object named Outbound Certificate is created. Use this in rules that inspect outbound HTTPS traffic in the HTTPS inspection Rule Base.
To create an outbound CA certificate:
In SmartDashboard, right-click the Security Gateway object and select Edit.
The Gateway Properties window opens.
In the navigation tree, select HTTPS Inspection.
In the HTTPS Inspection page, click Create.
Enter the necessary information:
Issued by (DN) - Enter the domain name of your organization.
Private key password - Enter the password that is used to encrypt the private key of the CA certificate.
Retype private key password - Retype the password.
Valid from - Select the date range for which the CA certificate is valid.
Exporting a Certificate from the Security Management Server
If you use more than one Security Management Server in your organization, you must first export the CA certificate using the export_https_cert CLI command from the Security Management Server on which it was created before you can import it to other Security Management Servers.
Usage:
export_https_cert [-local] | [-s server] [-f certificate file name under FWDIR/tmp][-help]
To export the CA certificate:
On the Security Management Server, run: $FWDIR/bin/export_https_cert -local -f [certificate file name under FWDIR/tmp]
For example: $FWDIR/bin/export_https_cert -local -f mycompany.p12
1. Check if connectivity exist between the 2 Gateway peers
2. VPN Debugging - Looking at the IKE negoatations
3. Can both sides see the IKE packets arriving during teh Key Exchange?
IKE Process (2 Phases)
Phase 1 - Main Mode (6 Packets)
Phase 2 - Quick Mode (3 Packets)
4. Turn VPN Debug On - enter the command "vpn debug on; vpn debug ikeon" or "vpn debug trunc".
The $FWDIR/log/ike.elg file contains information once debugging is enabled.
Checkpoint has a tool IKEView.exe - it parse information of ike.elg
5. Another tool is "vpn debug on mom" - it writes IKE captured data into file ikemonitor.snoop
This file is open with wireshark or ethereal.
Phase I
- Negotiates encryption methods (DES/3DES/AES etc)
- The key length
- The Hash Algorithm (MD5/SHA1)
- Creates a key to protect the messages of the exchange.
It does this in 5 stages:
1. Peers Authenticate using Certificates or a pre-shared secret.
2. Each peer generates a private Diffie-Hellman key from random bits and from that derives a DH public key. These are then exchanged.
3. Each peer generates a shared secret from its private key and its peers public key, this is the DH key.
4. The peers exchange DH Key material (random bits and mathematical data) and methods for PhaseII are agreed for encryption and integrity.
5. Each side generates a symmetric key (based upon the DH key and key material exchanged).
In IkeView under the IP address of the peer, open the Main Mode Packet 1 - expand :
> "P1 Main Mode ==>" for outgoing or "P1 Main Mode <==" for incoming
> MM Packet 1
> Security Association
> prop1 PROTO_ISAKMP
> tran1 KEY_IKE
You should then be able see the proposed Encryption Algorithm, Key Length, Hash Algorithm, Authentication Method, DH Group, and SA renegotiation params (life type - usually secs and duration).
UNDERSTAND THE 5 PACKETS
- If your encryption fails in Main Mode Packet 1, then you need to check your VPN communities.
- Packet 2 ( MM Packet 2 in the trace ) is from the responder to agree on one encryption and hash algorithm
- Packets 3 and 4 arent usually used when troublshooting. They perform key exchanges and include a large number called a NONCE. The NONCE is a set of never before used random numbers sent to the other part, signed and returned to prove the parties identity.
- Packets 5 and 6 perform the authentication between the peers. The peers IP address shows in the ID field under MM packet 5. Packet 6 shows that the peer has agreed to the proposal and has authorised the host initiating the key exchange.
NOTE:
1. If your encryption fails in Main Mode Packet 1, then you need to check your VPN communities.
2. If your encryption fails in Main Mode Packet 5, then you need to check the authentication - Certificates or pre-shared secrets
PHASE II
Next is Phase II - the IPSec Security Associations (SAs) are negotiated,
- The shared secret key material used for the SA is determined and there is an additional DH exchange.
- Phase II failures are generatlly due to a misconfigured VPN domain.
- Phase II occurs in 3 stages:
1. Peers exchange key material and agree encryption and integrity methods for IPSec.
2. The DH key is combined with the key material to produce the symmetrical IPSec key.
3. Symmetric IPSec keys are generated.
-----------------------------------------------------------------------------------------------------
Debug
-------
1. Turn on debugs
vpn debug trunc
vpn debug on TDERROR_ALL_ALL=5
2. Run the following command to reset the tunnel
(not needed if you are testing a Remote Access VPN):
vpn tu
Then select the option that reads,
"Delete all IPsec+IKE SAs for a given peer (GW)"
enter your remote GW ip address
exit the utility
3. Try to build the tunnel back up again, in both directions,
attempt to connect from YOUR NETWORK to a device in
the remote encryption domain and then attempt to connect
from THE REMOTE NETWORK to a device in the local
encryption domain.
4. Turn off debugs
vpn debug ikeoff
vpn debug off
debug file location:
SecurePlatform - $FWDIR/log/ike.elg*
$FWDIR/log/vpnd.elg*
Windows - %FWDIR%\log\ike.elg*
%FWDIR%\log\vpnd.elg*
Gather the following information to resolve the VPN related issues:
1.CPINFO from the Security Management server. Refer to sk30567.
2.Encryption Integrity, Encryption Strengths, DH group, IPsec lifetime for Phase 1 and 2 and the networks proposed on each end.
Fill out the following table for each end-point of the tunnel
1.Check Point Site Info:
Phase 1 - Encryption Strength (3Des, Des, AES256) = - Encryption Integrity (MD5, SHA1) = - Diffie-Hellman Group for IKE (phase 1) (group 1, 2, 5) = - Renegotiate IKE (phase 1) (1400 minutes) = - Support Aggressive mode (yes, no) =
2. Are you using Pre-Shared secrets or Certificates? 3. Are they able to establish the tunnel one-way? If so which way? 4. What are the IP addresses that you are testing from and two in your
encryption domains? 5. What is the IP address and name of the security gateway in question? 6. What is the IP address and name of the remote VPN site? Also, what is
the type of VPN appliance being used?
1. Remote Site Info:
Phase 1
- Encryption Strength (3Des, Des, AES256) = - Encryption Integrity (MD5, SHA1) = - Diffie-Hellman Group for IKE (phase 1) (group 1, 2, 5) = - Renegotiate IKE (phase 1) (1400 minutes) = - Support Aggressive mode (yes, no) =
2. Are you using Pre-Shared secrets or Certificates? 3. Are they able to establish the tunnel one-way? If so which way? 4. What are the addresses that you are testing from and two in your
encryption domains.
3.The IKE.elg and vpnd.elg files which include an easily identified period when a connection is being tested. Follow the below procedure to create theIKE.elg and vpnd.elg debug files:
a.Delete the $FWDIR/log/IKE.elg and the $FWDIR/log/vpnd.elg files from the security gateway.
b.On the security gateway run "vpn tu" or "vpn tunnelutil". This will bring up the following options:
(exception in NGX there is an addition option to Delete User with IPsec)
********** Select Option **********
(1) List all IKE SAs (2) List all IPsec SAs (3) List all IKE SAs for a given peer (4) List all IPsec SAs for a given peer (5) Delete all IPsec SAs for a given peer (6) Delete all IPsec+IKE SAs for a given peer (7) Delete all IPsec SAs for ALL peers (8) Delete all IPsec+IKE SAs for ALL peers (A) Abort
*******************************************
Select either option #6 and put in the remote site IP address or select option #8 and delete all the tunnels IPsec and IKE SAs. This will delete the IPsec and IKE SAs and this will send a delete IKE SA packet to the remote side telling it to take down the exciting tunnel.
c.Run "vpn debug ikeon" to enable the IKE debugging.
d.From either side of the security gateway generate traffic through the tunnel.
e.Once the tunnel fails, run "vpn debug ikeoff".
f.The IKE.elg file will be created in the $FWDIR/log directory on the security gateway.
I compiled a list of VPN debugs, error messages, and common gotchas. This information is relevant for Check Point NGX firewall, but is not a complete VPN Debugging Guide.
DEBUGGING INSTRUCTIONS:
From the command line ( if cluster, active member )
·vpn debug on
·vpn debug ikeon
·vpn tu
·select the option to delete IPSEC+IKE SAs for a given peer (gw)
·Try the traffic to bring up the tunnel
·vpn debug ikeoff
·vpn debug off
Log Files are
·$FWDIR/log/ike.elg
·$FWDIR/log/vpnd.elg
COMMON MESSAGES:
According to the Policy the Packet should not have been decrypted
·The networks are not defined properly or have a typo
·Make sure VPN domains under gateway A are all local to gateway A
·Make sure VPN domains under gateway B are all local to gateway B
Wrong Remote Address
Failed to match proposal
·sk21636 – cisco side not configured for compression
No response from peer
·check encryption domains.
·remote end needs a decrypt rule
·remote firewall not setup for encryption
·something is blocking communication between VPN endpoints
·Check UDP 500 and protocol 50
No Valid SA
·both ends need the same definition for the encrytpion domain.
·sk19243 – (LAST OPTION) use debedit objects_5_0.c, then add subnets/hosts in users.def
·likely phase2 settings
·cisco might say ‘no proxy id allowed”
·Disable NAT inside VPN community
·Support Key exchange for subnets is properly configured
·Make sure firewall external interface is in public IP in general properties
No Proposal chosen
·sk19243 – usually cuased when a peer does not agree to VPN Domain or subnet mask
·make sure that encryption and hash match as well in Phase 2 settings
Cannot Identify Peer (to encryption connection)
·sk22102 – rules refer to an object that is not part of the local firewalls encryption domain
·2 < agree on one encryption & hash, responder cookie (clear text)
·3 > random numbers sent to prove identity (if it fails here, reinstall)
·4 < random numbers sent to prove identity (if it fails here, reinstall)
·5 > authentication between peers, peers ip address, certificates exchange, shared secrets, expired certs, time offsets
·6 < peer has agreed to the proposal and has authenticated initiator, expired certs, time offsets
PHASE 2 (QUICK MODE)
·1 > Use a subnet or a host ID, Encryption, hash, ID data
·2 < agrees with it’s own subnet or host ID and encryption and hash
·3 > completes IKE negotiation
GOOD SKS to KNOW
·sk31221 – The NGX Advanced Troubleshooting Reference Guide (ATRG)
·sk26362 – Troubleshooting MTU related issues
·sk30509 – Configuring VPN-1/FireWall-1
·sk31567 – What is ike.elg?
·sk20277 – “Tunnel failure, cannot find IPSec methods of the community (VPN Error code 01)” appears
·sk31279 – Files copied over encrypted tunnel displaying error: “network path is too deep”
·sk32648 – Site-to-site VPN using certificates issued by the ICA (Internal Certificate Authority) fails
·sk19243 – largest possible subnet even when the largest_possible_subnet option is set to false
·sk31619 – VPN tunnel is down troubleshooting
·sk19599 – how to edit user.def for largest possible subnets & host only
VPN Peer: 216.231.83.36
Phase 1 IKE Properties:
Key Exchange: 3DES
Data Integrity: SHA256
Renegotiate IKE SA: 86400 seconds
DH-Group: Group 2
Phase 2 IPSEC Properties:
Data Encryption: 3DES
Data Integrity: SHA256
Perfect Forward Secrecy: Enabled
Renegotiate IPSEC SA’s Every: 3600 Seconds
216.231.67.57 our side
10.160.242.71 cisco side
encryption failure: error occured on the implied rule
reviewed config, looks fine
most likely encryption dislike from the cisco side
he mentioned that setting the encryption to 3DES and MD5 allows the tunnel to come up
they have a conf call with them in an hour
gave him the below debug to run if the encryption tweaks on the cisco side don't resolve the issue
1. Delete all $FWDIR/log/ike.elg and vpnd.elg files
# cd $FWDIR/log/
# rm ike.elg.*
# rm vpnd.elg.*
2. Delete all IPSec+ IKE SAs for the given peer through
# vpn tu
3. Start ike debug
# vpn debug ikeon (creates the ike.elg file)
# vpn debug trunc
4. Replicate the problem
5. Stop ike debug
# vpn debug ikeoff
# vpn debug off
6. Send me all of the $FWDIR/log/ike.elg and $FWDIR/log/vpnd.elg files for further review.
Proxy ID - 216.231.64.0/19 (neehan stuff) 10.15.0.0/16 tumbleweed
ENCRYPTION
----------
IKE Security Association (Phase 1) Properties:
-Performed Key Exchange encryption with: ASE-256
-Perform Data Integrity with: SHA-256
IPsec Security Association (Phase 2) Properties
Perform IPsec data encryptoin with: 3DES
Perform data Integrity with: MD5
TUNNEL MANAGEMENT
-----------------
- One VPN tunnel per each pair of hosts
- One VPN tunnel per subnet pair (each subnet create a new SA (security Association) proxyID is Network in the master Encryption domain
- One VPN tunnel per Gateway pair (one SA created for Gateway pair - ProxyID is 0.0.0.0.0/0.0.0.0.0)
ADVANCE VPN PROPERTIES
----------------------
VPN Routing for satellites:
To Center only
Shared Secret - peer name -shared secret
IKE Phase 1
Diffie-Hellman group: group 2 (1024 bits)
Renegotiate IKE security association every: 480 minuits
IPSec (Phase 2)
Use Perfect Forward Secrety
Diffie-Hellman group: group 2 (1024 bits)
debug files first taken didn't capture the negotiation
cisco router VPN
216.231.83.36 our side
10.160.242.71 cisco side peer 54.152.244.11
took the remote and reran them
had them go for a bit longer
reviewed the files
QM P1 failure, we send them:
[vpnd 5356 1988448384]@hinoff-fwb.bcbsma.com[24 Jun 23:42:27] allocateSpi: Allocated SPI: 0x570a57c2, 0 collisions (currently 1 reserved).
[vpnd 5356 1988448384]@hinoff-fwb.bcbsma.com[24 Jun 23:42:27] QMCreate1: rangeUsed: 1 my [0-ffffffff] peer [0-ffffffff]
[vpnd 5356 1988448384]@hinoff-fwb.bcbsma.com[24 Jun 23:42:27] RESULT: range_first 0 last ffffffff subnet_addr 0 mask 0
[vpnd 5356 1988448384]@hinoff-fwb.bcbsma.com[24 Jun 23:42:27] RESULT: range_first 0 last ffffffff subnet_addr 0 mask 0
They don't like the all 0's subnets and return with no proposal chosen
they haven't configured their side to accept 0.0.0.0 encryption domain which we send because we have it set to "one vpn tunnel per gateway pair"
changed to "one vpn tunnel per subnet pair" and installed policy
will initiate the tunnel for testing at a later time as the other team has left
Number: 3446237
Date: 19Jan2012
Time: 23:17:13
Interface: daemon
Origin: lanvpn-fwa
Type: Log
Action: Key Install
Source: lanvpn-fwa (10.210.0.220)
Destination: 199.204.139.93
Community: MYTUNNEL
Information: IKE: Main Mode completion [UDP].
Encryption Scheme: IKE
Encryption Methods: 3DES + SHA1, Pre shared secrets
IKE Initiator Cookie: 4619fb5980099913
IKE Responder Cookie:6ac91b5a9949dcf4
VPN Peer Gateway: 199.204.139.93
Subproduct: VPN
VPN Feature: IKE
Product: Security Gateway/Management
VPN Peer: 216.231.183.136 Phase 1 IKE Properties:
Key Exchange: 3DES
Data Integrity: SHA256
Renegotiate IKE SA: 86400 seconds
DH-Group: Group 2
Phase 2 IPSEC Properties:
Data Encryption: 3DES
Data Integrity: SHA256
Perfect Forward Secrecy: Enabled
Renegotiate IPSEC SA’s Every: 3600 Seconds
Additional Notes
216.231.67.57 our side
10.160.242.71 cisco side
encryption failure: error occured on the implied rule
reviewed config, looks fine
most likely encryption dislike from the cisco side
he mentioned that setting the encryption to 3DES and MD5 allows the tunnel to come up
they have a conf call with them in an hour
gave him the below debug to run if the encryption tweaks on the cisco side don't resolve the issue
1. Delete all $FWDIR/log/ike.elg and vpnd.elg files
# cd $FWDIR/log/
# rm ike.elg.*
# rm vpnd.elg.*
2. Delete all IPSec+ IKE SAs for the given peer through
# vpn tu
3. Start ike debug
# vpn debug ikeon (creates the ike.elg file)
# vpn debug trunc
4. Replicate the problem
5. Stop ike debug
# vpn debug ikeoff
# vpn debug off
6. Send me all of the $FWDIR/log/ike.elg and $FWDIR/log/vpnd.elg files for further review.
Proxy ID - 216.231.64.0/19 (my stuff) 10.15.0.0/16 ftp
ENCRYPTION
----------
IKE Security Association (Phase 1) Properties:
-Performed Key Exchange encryption with: ASE-256
-Perform Data Integrity with: SHA-256
IPsec Security Association (Phase 2) Properties
Perform IPsec data encryptoin with: 3DES
Perform data Integrity with: MD5
TUNNEL MANAGEMENT
-----------------
- One VPN tunnel per each pair of hosts
- One VPN tunnel per subnet pair (each subnet create a new SA (security Association) proxyID is Network in the master Encryption domain
- One VPN tunnel per Gateway pair (one SA created for Gateway pair - ProxyID is 0.0.0.0.0/0.0.0.0.0)
ADVANCE VPN PROPERTIES
----------------------
VPN Routing for satellites:
To Center only
Shared Secret - peer name -shared secret
IKE Phase 1
Diffie-Hellman group: group 2 (1024 bits)
Renegotiate IKE security association every: 480 minuits
IPSec (Phase 2)
Use Perfect Forward Secrety
Diffie-Hellman group: group 2 (1024 bits)
debug files first taken didn't capture the negotiation
cisco router VPN
216.231.183.36 our side
10.160.242.171 cisco side peer 54.152.244.11
took the remote and reran them
had them go for a bit longer
reviewed the files
QM P1 failure, we send them:
[vpnd 5356 1988448384]@myoff-fwb.mydomain.com[24 Jun 23:42:27] allocateSpi: Allocated SPI: 0x570a57c2, 0 collisions (currently 1 reserved).
[vpnd 5356 1988448384]@myoff-fwb.mydomain.com[24 Jun 23:42:27] QMCreate1: rangeUsed: 1 my [0-ffffffff] peer [0-ffffffff]
[vpnd 5356 1988448384]@myoff-fwb.mydomain.com[24 Jun 23:42:27] RESULT: range_first 0 last ffffffff subnet_addr 0 mask 0
[vpnd 5356 1988448384]@myoff-fwb.mydomain.com[24 Jun 23:42:27] RESULT: range_first 0 last ffffffff subnet_addr 0 mask 0
They don't like the all 0's subnets and return with no proposal chosen
they haven't configured their side to accept 0.0.0.0 encryption domain which we send because we have it set to "one vpn tunnel per gateway pair"
changed to "one vpn tunnel per subnet pair" and installed policy
will initiate the tunnel for testing at a later time as the other team has left
--------------------------------------------------------------------------------
Your Public IP is used for Phase I,
internal IP(s) for Phase II.
Phase II is only allowed with any particular subnet if it is defined in the encryption domain.
For example, if you had:
LAN1 = 10.0.10.0/24
LAN2 = 10.0.11.0/24
DMZ = 172.16.0.0/23
Let's say you need to encrypt LAN1 and DMZ to a DR site so you can replicate data. On the CP side, you should have/create a group, let's call it "site_a_enc_domain" for this example. You should also create network objects representing your segments listed above. You would need to add the LAN1 and DMZ network objects to that group.
Then, in gateway/cluster properties -> Topology tab -> Manually Defined: Drop down the box and select the group you created.
For Phase I setup, you need to:
1) Create an Interoperable device and define the Public IP used for the VPN
2) Create a network(s) that represents the remote side INTERNAL/PRIVATE network (or multiples and add them to a group as you did on your side)
3) Assign that group/network as the encryption domain for that remote firewall object
4) This step differs depending on Traditional or Simplified VPN mode
As for the rules you will need for Phase II... Again, that depends on what you are running - Traditional or Simplified VPN mode
At a minimum, this should allow you to look around at the others and figure it out. Let us know if you need more help.
1. IKE negotation between the 2 peers
2. Can both sides see the IKE packets arriving during a key exchange?
IKE negotiation consists of two phases -
Phase I (Main mode which is six packets) and
Phase II (Quick Mode which is three packets).
Phase I negotiates encryption methods (DES/3DES/AES etc), the key length, the hash Algorithm (MD5/SHA1) and creates a key to protect the messages of the exchange.
It does this in 5 stages:
1. Peers Authenticate using Certificates or a pre-shared secret.
2. Each peer generates a private Diffie-Hellman key from random bits and from that derives a DH public key.
3. These are then exchanged.
4. Each peer generates a shared secret from its private key and its peers public key, this is the DH key.
5. The peers exchange DH Key material (random bits and mathematical data) and methods for PhaseII are agreed for encryption and integrity.
6. Each side generates a symmetric key (based upon the DH key and key material exchanged).
In IkeView under the IP address of the peer, open the Main Mode Packet 1 - expand :
> "P1 Main Mode ==>" for outgoing or "P1 Main Mode <==" for incoming
> MM Packet 1
> Security Association
> prop1 PROTO_ISAKMP
> tran1 KEY_IKE
You should then be able see the proposed Encryption Algorithm, Key Length, Hash Algorithm, Authentication Method, DH Group, and SA renegotiation params (life type - usually secs and duration).
If your encryption fails in Main Mode Packet 1, then you need to check your VPN communities.
Packet 2 ( MM Packet 2 in the trace ) is from the responder to agree on one encryption and hash algorithm
Packets 3 and 4 arent usually used when troublshooting. They perform key exchanges and include a large number called a NONCE. The NONCE is a set of never before used random numbers sent to the other part, signed and returned to prove the parties identity.
Packets 5 and 6 perform the authentication between the peers. The peers IP address shows in the ID field under MM packet 5. Packet 6 shows that the peer has agreed to the proposal and has authorised the host initiating the key exchange.
If your encryption fails in Main Mode Packet 5, then you need to check the authentication - Certificates or pre-shared secrets
PHASE II
Phase II - the IPSec Security Associations (SAs) are negotiated, the shared secret key material used for the SA is determined and there is an additional DH exchange.
Phase II failures are generatlly due to a misconfigured VPN domain. Phase II occurs in 3 stages:
1. Peers exchange key material and agree encryption and integrity methods for IPSec.
2. The DH key is combined with the key material to produce the symmetrical IPSec key.
3. Symmetric IPSec keys are generated.
In IkeView under the IP address of the peer, expand Quick Mode packet 1:
> "P2 Quick Mode ==>" for outgoing or "P2 Quick Mode <==" for incoming
> QM Packet 1
> Security Association
> prop1 PROTO_IPSEC_ESP
> tran1 ESP_AES (for an AES encrypted tunnel)
You should be able to see the SA life Type, Duration, Authentication Alg, Encapsulation Mode and Key length.
If your encryption fails here, it is one of the above Phase II settings that needs to be looked at.
There are two ID feilds in a QM packet. Under
> QM Packet 1
> ID
You should be able to see the initiators VPN Domain configuration including the type (ID_IPV4_ADDR_SUBNET) and data (ID Data field).
Under the second ID field you should be able to see the peers VPN Domain configuration.
Packet 2 from the responder agrees to its own subnet or host ID, encryption and hash algorithm.
Packet 3 completes the IKE negotiation.
If all of this works without any errors, then you may have previously initiated an invalid tunnel previously. You can use the VPN tunnel utility "vpn tu" to remove SA keys from the table.
DEBUGGING INSTRUCTIONS:
From the command line ( if cluster, active member )
vpn debug on
vpn debug ikeon
vpn tu
select the option to delete IPSEC+IKE SAs for a given peer (gw)
Try the traffic to bring up the tunnel
vpn debug ikeoff
vpn debug off
Log Files are
$FWDIR/log/ike.elg
$FWDIR/log/vpnd.elg
COMMON MESSAGES:
According to the Policy the Packet should not have been decrypted
The networks are not defined properly or have a typo
Make sure VPN domains under gateway A are all local to gateway A
Make sure VPN domains under gateway B are all local to gateway B
Wrong Remote Address
Failed to match proposal
sk21636 – cisco side not configured for compression
No response from peer
check encryption domains.
remote end needs a decrypt rule
remote firewall not setup for encryption
somethign is blocking communication between VPN endpoints
Check UDP 500 and protocol 50
No Valid SA
both ends need the same definition for the encrytpion domain.
sk19243 – (LAST OPTION) use debedit objects_5_0.c, then add subnets/hosts in users.def
likely phase2 settings
cisco might say ‘no proxy id allowed”
Disable NAT inside VPN community
Support Key exchange for subnets is properly configured
Make sure firewall external interface is in public IP in general properties
No Proposal chosen
sk19243 – usually cuased when a peer does not agree to VPN Domain or subnet mask
make sure that encryption and hash match as well in Phase 2 settings
Cannot Identify Peer (to encryption connection)
sk22102 – rules refer to an object that is not part of the local firewalls encryption domain
Notes:vpn debug trunc - This command initiates both VPND debug and IKE debugvpn debug on TDERROR_ALL_ALL=5 - the level of detail providedfwaccel off - Disable SecureXL
Solution
It is very helpful to gather the IKE information in both directions. This allows you to see what each VPN Gateway proposes to the other in order to reconcile the differences.
This can be done by having both endpoints initiate communications at different times and generating debug output for IKE and VPND on both sides.
These debugs are valid for VPN connections between SecureClient and Security Gateways, as well as for Site-to-Site VPN connections.
Note: This article is also relevant for Site-to-Site VPN with 3rd Party VPN Gateways.
Follow the steps below to generate debug information: Note: For SecurePlatform or Gaia OS, you must be logged in as Expert.
Initiate debug of VPND daemon on Check Point Security Gateway from the CLI: [Expert@HostName]# vpn debug trunc Notes:
This command initiates both VPND debug and IKE debug, whereas the 'vpn debug on' command only initiates VPND debug.
If you also need the level of detail provided by TDERROR_ALL_ALL=5, then you also need to run: [Expert@HostName]# vpn debug on TDERROR_ALL_ALL=5 This must be run after the command 'vpn debug trunc'.
Disable SecureXL: [Expert@HostName]# fwaccel off [Expert@HostName]# fwaccel stat
Initiate a packet capture on the Security Gateways involved in Site-to-Site VPN (or tcpdump, or Wireshark pcap): Notes:
You can press "Alt + F1" to open a second terminal, or open a second SSH session, or (for Windows) open a second command prompt. [Expert@HostName]# fw monitor -e "accept;" -o /var/log/fw_monitor.cap
or [Expert@HostName]# fw monitor -e "accept port(500) or port(4500);" -o /var/log/fw_monitor.cap
or [Expert@HostName]# vpn debug mon
If you run 'vpn debug mon', the output file is 'ikemonitor.snoop'. In this output file, all the IKE payloads are in clear text. Whereas, in 'fw_monitor.cap' file, all the IKE payloads are encrypted.
Launch the TunnelUtil tool, which is used to control VPN tunnels: [Expert@HostName]# vpn tu Note: Before running the 'vpn tu' command, kill all traffic over the VPN. This will include stopping all continuous traffic across the VPN tunnel.
Then select the option "Delete all IPsec+IKE SAs for a given peer (GW)".
Enter your remote Security Gateway IP address.
Exit from the 'vpn tu' utility. Important note: This procedure closes open VPN tunnels. This can be useful because the next time communication is attempted you will capture the VPN tunnel creation information. Please be aware that existing VPN tunnels with this remote peer will be closed and will have to be reestablished. This is especially important in a Production environment. If the remote peer is a third-party device, then it is important to also clear the keys on the remote peer device. Clearing the keys on only the Check Point gateway will often cause a problem where the remote peer refuses to allow the Check Point to establish a new key because it already has one.
If it is not possible to clear the keys on both the Check Point gateway and the remote third-party peer, DO NOT clear the key on only the Check Point gateway! In that case, skip this step completely.
Reproduce the issue, attempt to connect FROM YOUR NETWORK to a device in the remote encryption domain. This initiates the tunnel.
Launch the TunnelUtil tool, which is used to control VPN tunnels: [Expert@HostName]# vpn tu Note: Before running the 'vpn tu' command, kill all traffic over the VPN.
Select the option that "Delete all IPsec+IKE SAs for a given peer (GW)".
Enter your remote Security Gateway IP address.
Exit from the 'vpn tu' the utility.
Reproduce the issue, attempt to connect FROM THE REMOTE NETWORK to a device in the local encryption domain. This initiates the tunnel.
Stop debug of VPND daemon on the Security Gateways involved in Site-to-Site VPN: [Expert@HostName]# vpn debug truncoff Note: If you used 'vpn debug mon' command, you need to run 'vpn debug moff'.
Stop packet capture by pressing "CTRL+C".
If SecureXL was disabled, re-enable it: [Expert@HostName]# fwaccel on [Expert@HostName]# fwaccel stat
Important: Before running any debug, consult with Check Point Support. Depending on your specific issue, you may need to set different debug flags.
Perform the following debug procedure on the problematic VPN Security Gateway. Note: In cluster environment, this procedure must be performed on all members of the cluster.
Launch the TunnelUtil tool, which is used to control VPN tunnels: [Expert@HostName]# vpn tu Note: Before running the 'vpn tu' command, kill all traffic over the VPN.
The following menu will be displayed (available options differ between Security Gateway versions):
********** Select Option **********
(1) List all IKE SAs
(2) List all IPsec SAs
(3) List all IKE SAs for a given peer (GW) or user (Client)
(4) List all IPsec SAs for a given peer (GW) or user (Client)
(5) Delete all IPsec SAs for a given peer (GW)
(6) Delete all IPsec SAs for a given User (Client)
(7) Delete all IPsec+IKE SAs for a given peer (GW)
(8) Delete all IPsec+IKE SAs for a given User (Client)
(9) Delete all IPsec SAs for ALL peers and users
(0) Delete all IPsec+IKE SAs for ALL peers and users
(Q) Quit
*******************************************
Select the relevant option:
Either delete all IPsec SAs for a given peer (GW) (option #5 in current example) and enter IP address of the involved remote site,
Or delete all IPsec+IKE SAs for a given peer (GW) (option #7 in current example) (this will delete the IPsec and IKE SAs and will send a delete IKE SA packet to the remote site telling it to take down the existing tunnel).
Enable VPND and IKE debug: [Expert@HostName]# vpn debug trunc [Expert@HostName]# vpn debug on TDERROR_ALL_ALL=5
Start FW Monitor:
Note: For syntax, refer to sk30583 - What is FW Monitor?. [Expert@HostName]# fw monitor -e "accept;" -o /var/log/fw_mon_traffic.cap
Start kernel debug in a new shell: [Expert@HostName]# fw ctl debug 0 [Expert@HostName]# fw ctl debug -buf 32000 [Expert@HostName]# fw ctl debug -m fw + conn drop vm crypt [Expert@HostName]# fw ctl debug -m VPN all [Expert@HostName]# fw ctl kdebug -T -f > /var/log/kernel_debug.txt
Initialize traffic from both sides through the VPN tunnel.
Replicate the issue.
Stop kernel debug:
Press CTRL-C and run [Expert@HostName]# fw ctl debug 0
Stop FW Monitor:
Press CTRL-C
Stop VPND and IKE debug: [Expert@HostName]# vpn debug off [Expert@HostName]# vpn debug ikeoff
