Name the Subordinate CA (for example: Intermediate CA or Godaddy-inter ca).Īccept the prompt, select the certificate from step 13: Click on More and choose Subordinate CA.Īfter you choose Subordinate CA, a Dialog Box appears. Then click on More and find the Server option. Install the Intermediate Certificate as a Subordinate CA.

Choose the desired Root CA certificate.Īfter you choose the certificate, you are prompted to accept the certificate, as seen below:

Select the OPSEC PKI option and click on GET.Ī Windows dialog box appears. Give the Trusted CA a name (for example: Root CA or Godadd圜A).

Find the Server option, click on More, and choose Trusted CA.Īfter you choose Trusted CA, a dialog box appears. Accordingly, we will install the Root Certificate as a Trusted CA and the Intermediate Certificate as a Subordinate CA. For instance: if the third-party Trusted Certificate is from Entrust get the Root and Intermediate Certificates first.Īs you can see, the Root is and the Intermediate is Entrust Certificate Authority – L1K. Check with your Certificate Authority and get the CA (root) certificate and the intermediate certificate.I think the second error is because now the Gateway thinks it needs to Decrypt and it´s clear text or something.Generate and install a third-party IPSec Certificate Domain of the Gateway, however this simply changed the error output to: I don´t understand the drop because the packet should be Clear text and only be encrypted by the checkpoint and decrypted by the client, I don´t see the difference between this and any other network access, I wondering if It has to do with the Topology since this network is not directly connected, however there is a route so it should be 'known' in terms of topology.Īfter this I tried adding the Remote Office Pool to the Enc. Problem is when the client tries to reach network packet is forwarded to server, return packet however is blocked by checkpoint with following error:ĭropped by vpn_verify, reason : Clear packet on encrypted connection Network 192.168.2.0/24 is part of Enc Domain of Checkpoint for Remote VPN I have come upon this issue where a customer is trying to access a Network scope behind a tunnel that is terminating on a 3rd party device.Ĭlient VPN client with remote office IP 10.1.1.2 want´s to reach Server Behind Tunnel Terminating on 3rd party firewall with IP 192.168.2.2Ĭheckpoint has route for 192.168.2.0/24 -> 3rd party deviceģrd Party device has route to 10.1.1.0/24 -> checkpoint

Check point add 3rd party cert to vpn