Site Says It Is Not a Certificate Authority

[roadrunner]

Site Says It Is Not a Certificate Authority
When you try and add a firewall as a site in SecuRemote, you see the following error message:


Error: Site xxx.xxx.xxx.xxx says that it is not a Certificate Authority. Check whether you have got the right IP address for xxx.xxx.xxx.xxx, and check with the FW-1 system manager there whether xxx.xxx.xxx.xxx is indeed a FW-1 control station.
If the management console and firewall module are on separate boxes, you add the IP address of the management console for the firewall in question. You can use the firewall module only if you have SecuRemote licenses installed on the firewall module. Conversely:


The management console must have a routable address. If it does not have a routable address, you will need to set up a static address translation for it.
SecuRemote Clients must be able to access the management console or firewall via the "FW1_topo" service (TCP port 264) if you are using Secure Client 4.1 (4110 and above builds of SecuRemote) with FireWall-1 4.1. You must allow the 'FW1' service (TCP port 256) if you are using a SecuRemote 4.0 client or using FireWall-1 4.0.
Your Certificate Authority must have an FWZ CA key generated or be configured with IKE. Look at your firewall object, ensure FWZ or IKE is checked in the encryption tab, and make sure a CA key is generated for FWZ.
If you are using Secure Client 4.1 with FireWall-1 4.0, you must have FWZ checked in your VPN tab and have encryption keys defined even if you only intend on using ISAKMP. What the user will actually use for encryption is determined in his user record in FireWall-1. Note you can get around this limitation if you uncheck the "Respond to Cleartext Topology Requests" in Policy Properties, Encryption tab.
In 4.1 SP5 and above, you will want to ensure that "Respond to Unauthenticated Topology Requests" is disabled. In NG, this option is not present.
If you just recently installed your SecuRemote licenses, you will need to restart FireWall-1 before the licenses will take effect.

-- PhoneBoy - 13 Apr 2004


FAQForm
FAQs.Class: SecureClientFAQs, TroubleshootingFAQs
FAQs.OS:
FAQs.Version: