SIC error

[Steve]

getting SIC error 111 - unable to initialise sic as peer does not have a certificate....

anyone seen this before? I have re-initialised the CA on the manager but still the same.

Running cp r55 on manager and firewall.

thanks.

[kva.kva]

Try to debug - https://secureknowledge.checkpoint.c....do?id=sk30579

Very often mistakes from this SK article -
"...Verify the SmartCenter Server's IP address and name are in the HOSTS file on the remote Gateway.
NOTE: If the IP address of the SmartCenter Server uses static NAT, add the public IP address of the SmartCenter Server to the HOSTS file on the remote Gateway, to resolve to its hostname.

Verify correct date and time on the operating systems. If the SmartCenter Server and remote Gateway reside in two different time zones, the remote Gateway may need to wait for the Certificate to become valid..."

[bvanniekerk]

Hi

You've checked hostname used in Internal CA is the same as Master in objects.C file?
Check if Internal CA generated has the fwm server name in ...;O=<fwm>;...
This shold also be in host file.

Rgrds
b

[freinet]

Hi, I think this comes way too late but maybe someone will face this problem again somtime:

If you connect the SmartCenter to a switchport in a VLAN and use VLANs on the enforcement module, you have to reduce the the MTU on the SmartCenter interface to 1496 Bytes. Otherwise, the 4-byte VLAN tag seems to disturb the certificate operation.

[MorfiusX]

Originally Posted by freinet

Hi, I think this comes way too late but maybe someone will face this problem again somtime:

If you connect the SmartCenter to a switchport in a VLAN and use VLANs on the enforcement module, you have to reduce the the MTU on the SmartCenter interface to 1496 Bytes. Otherwise, the 4-byte VLAN tag seems to disturb the certificate operation.

Just a note. I had a new system being set up in an on site environment. Once I got everything working, I moved the gateways to an off site data center. The SmartCenter machine stayed at the on site location. When I moved the gateways, I ran into the error above. Setting the MTU resolved the problem.