Yesterday I received a message in the debian-user-spanish mailing list with subject: Conectarse por VPN a un Firewall-1

In that email the user was referring to very useful tutorial: Check Point Firewall-1 NG(X). I remembered that link as I used it to configure my first road warrior VPN client. But this document is outdated as the procedure to obtain the private key is not valid anymore. There is a new procedure that I documented in my personal wiki. In this post I am gonna copy & paste the right procedure from it.

This is a almost copy and paste procedure post. I am not going to explain all the “History/Theory” as it has been already well documented in the Check Point Firewall-1 NG(X) tutorial.

Get the needed files from the .pk12 certificate and put them in the right directories:

Retrieving DER-encoded CRL from CheckPoint

wget http://firewall-1:18264/ICA_CRL1.crl

Converting DER-encoded CRL to PEM-encoded and store it in related directory

openssl crl -in ICA_CRL1.crl -inform DER -outform PEM -out /etc/ipsec.d/crls/checkpoint.crl

Convert user certificate generated by Check Point Management from PKCS#12 to X.509

Extract private key of user PKCS#12, you have to specify first the import password (remember: given in GUI) and an export password

openssl pkcs12 -in vpnjuan.p12 -nocerts -out tempkey.pem

Convert private key of user to RSA:

openssl rsa -in tempkey.pem -des3 -out /etc/ipsec.d/private/vpnjuan-key.pem

Copy firewall-1-cert.pem (provided by your network admin) in /etc/ipsec.d/certs/firewall-1-cert.pem

Extract certificates of user from PKCS#12 to X.509 (results in a file containing the CA and the user certificate)

openssl pkcs12 -in vpnjuan.p12 -nokeys -out temp2.pem

Split singe file into different ones, results in e.g. firewall-1-internal-ca.pem (CA certificate is first one in file) and vpnjuan-cert.pem (user certificate is normally the second one in file) The header part of the CA certificate is like:

subject=/O=checkpoint.intranet.example.com..p9bkhs

issuer= /O=checkpoint.intranet.example.com..p9bkhs

The header of the user certificate is like:

subject=/O=checkpoint.intranet.example.com..p9bkhs/OU=users/CN=freeswan

issuer=/O=checkpoint.intranet.example.com..p9bkhs

Copy user X.509 certificate to related Openswan directory

cp vpnjuan-cert.pem /etc/ipsec.d/certs

Copy firewall-1 CA certificate to related Openswan directory

cp firewall-1-internal-ca.pem /etc/ipsec.d/cacerts

Modifying the .conf files:

Add the following line to /etc/ipsec.secrets

: RSA /etc/ipsec.d/private/vpnjuan-key.pem %prompt

Modify the /etc/ipsec.conf depending your own configuration:

# /etc/ipsec/ipsec.conf - Openswan IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.15.2.6 2006/10/19 03:49:46 paul Exp $

# This file:  /usr/share/doc/openswan-2.4.15-r2/ipsec.conf-sample
#
# Manual:     ipsec.conf.5

version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration
config setup
        # plutodebug / klipsdebug = "all", "none" or a combation from below:
        # "raw crypt parsing emitting control klips pfkey natt x509 private"
        # eg: plutodebug="control parsing"
        #
        # ONLY enable plutodebug=all or klipsdebug=all if you are a developer !!
        #
        # NAT-TRAVERSAL support, see README.NAT-Traversal
        nat_traversal=yes
        # virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
        #
        # enable this if you see "failed to find any available worker"
        nhelpers=0
#       plutodebug=all
        protostack=netkey
# Add connections here
# sample VPN connections, see /etc/ipsec.d/examples/

## RoadWarrior to Net behind Gateway: FreeS/WAN X.509 <-> Check Point - Net
conn MYCOMPANYCONNECTION
    # Right side is FreeS/WAN RoadWarrior
    right=%defaultroute
    rightrsasigkey=%cert
    rightcert=vpnjuan-cert.pem
    # Left side is Check Point
    left=X.X.X.X          ### put here your firewall's IP address
    leftsubnet=10.0.0.0/8 ### put here your company's network range
    leftcert=firewall-1-cert.pem
    leftid=X.X.X.X        ### put here your firewall's IP address
    # config
    type=tunnel
    keyingtries=3
    disablearrivalcheck=no
    authby=rsasig
    auth=esp
    keyexchange=ike
    auto=route

Procedure to connect:

Restart ipsec daemon to reread configuration:

mediacenter:/etc/ipsec.d/certs# service ipsec restart
ipsec_setup: Stopping Openswan IPsec...
ipsec_setup: stop ordered, but IPsec appears to be already stopped!
ipsec_setup: doing cleanup anyway...
ipsec_setup: Starting Openswan IPsec U2.6.28/K2.6.38-2-amd64...

Insert the passphrase of yout private key:

mediacenter:/etc/ipsec.d/certs# ipsec auto --rereadsecrets
040 need passphrase for '/etc/ipsec.d/private/vpnjuan-key.pem'
Enter passphrase:

Start the VPN:

mediacenter:/etc/ipsec.d/certs# ipsec auto –up MYCOMPANYCONNECTION

104 "MYCOMPANYCONNECTION" #1: STATE_MAIN_I1: initiate
003 "MYCOMPANYCONNECTION" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
106 "MYCOMPANYCONNECTION" #1: STATE_MAIN_I2: sent MI2, expecting MR2
003 "MYCOMPANYCONNECTION" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: i am NATed
108 "MYCOMPANYCONNECTION" #1: STATE_MAIN_I3: sent MI3, expecting MR3
004 "MYCOMPANYCONNECTION" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}
117 "MYCOMPANYCONNECTION" #2: STATE_QUICK_I1: initiate
003 "MYCOMPANYCONNECTION" #2: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME msgid=1a0f153c
004 "MYCOMPANYCONNECTION" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x6ae22f40 <0x4bca9ef5 xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=none DPD=none}

Launch the rdesktop (terminal server client for linux) against your Pc’s IP address and have fun!

mediacenter:/etc/ipsec.d/certs# rdesktop X.X.X.X