Troubleshooting Symantec Verisign SSL Certificates Issue on PKI VPN Tunnel between Juniper SRX Firewalls (Cont.)

PKI based IPSec Site to Site VPN becomes more and more populous. I had a previous post "Set up PKI IPSec VPN with Verisign SSL Certificates between Juniper SRX Firewalls" which records all steps how to set this kind of IPsec VPN up.

There are more related posts in this blog:

• Using Symantec SSL PKI to Authenticate Cisco IOS IPSec VPN - HA Deployment
• Using PKI Build Route-Based IPSec VPN between Juniper SRX
• Certification based Cisco IPSec VPN Down caused by 'signature invalid'
• Using Symantec Verisign SSL Certificate for Check Point SSL VPN Mobile Access Portal
• Using Symantec Verisign PKI to authenticate Checkpoint Site-to-Site IPSec VPN
• Cisco IKEv1 Site-to-Site IPSec Configuration on IOS Routers (2) - Using Two Different CA Certificates

This post is regarding some troubleshooting procedures for strange certificates issue during configuration PKI based IPSec vpn between Juniper SRX Firewalls.

Symptoms: 

The VPN Tunnel could not be built although all procedures have been followed, generated RSA key pair, generated CSR on both SRX firewalls, submitted CSR to SSL certification provider, received certificates for both devices, received CA certificates, and imported all certificates into devices.

Debugging IKE did not give too much information. But during verify certificates, I found these strange information:

@SRX1:

root@fw-SRX1-2> show security pki ca-certificate detail 
node0:
--------------------------------------------------------------------------
Certificate identifier: G5
  Certificate version: 3
  Serial number: 250ce8e030612e9f2b89f7054d7cf8fd
  Issuer:
    Organization: "VeriSign, Organizational unit: Class 3 Public Primary Certification Authority, Country: US
  Subject:
    Organization: "VeriSign, Organizational unit: VeriSign Trust Network, Organizational unit: "(c) 2006 VeriSign, Country: US, Common name: VeriSign Class 3 Public Primary Certification Authority - G5
  Subject string:
    C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2006 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G5
  Validity:
    Not before: 11- 8-2006 00:00 UTC
    Not after: 11- 7-2021 23:59 UTC
  Public key algorithm: rsaEncryption(2048 bits)
    30:82:01:0a:02:82:01:01:00:af:24:08:08:29:7a:35:9e:60:0c:aa
    e7:4b:3b:4e:dc:7c:bc:3c:45:1c:bb:2b:e0:fe:29:02:f9:57:08:a3
    64:85:15:27:f5:f1:ad:c8:31:89:5d:22:e8:2a:aa:a6:42:b3:8f:f8
    b9:55:b7:b1:b7:4b:b3:fe:8f:7e:07:57:ec:ef:43:db:66:62:15:61
    cf:60:0d:a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:54:85
    26:e5:2b:8f:1b:9f:eb:f5:a1:91:c2:33:49:d8:43:63:6a:52:4b:d2
    8f:e8:70:51:4d:d1:89:69:7b:c7:70:f6:b3:dc:12:74:db:7b:5d:4b
    56:d3:96:bf:15:77:a1:b0:f4:a2:25:f2:af:1c:92:67:18:e5:f4:06
    04:ef:90:b9:e4:00:e4:dd:3a:b5:19:ff:02:ba:f4:3c:ee:e0:8b:eb
    37:8b:ec:f4:d7:ac:f2:f6:f0:3d:af:dd:75:91:33:19:1d:1c:40:cb
    74:24:19:21:93:d9:14:fe:ac:2a:52:c7:8f:d5:04:49:e4:8d:63:47
    88:3c:69:83:cb:fe:47:bd:2b:7e:4f:c5:95:ae:0e:9d:d4:d1:43:c0
    67:73:e3:14:08:7e:e5:3f:9f:73:b8:33:0a:cf:5d:3f:34:87:96:8a
    ee:53:e8:25:15:02:03:01:00:01
  Signature algorithm: sha1WithRSAEncryption
  Distribution CRL:
    http://crl.verisign.com/pca3.crl
  Use for key: CRL signing, Certificate signing, TLS Web Server Authentication, 1.3.6.1.5.5.7.3.1, TLS Web Client Authentication, 1.3.6.1.5.5.7.3.2, Code Signing, 1.3.6.1.5.5.7.3.3, Netscape Server Gated Crypto,
  2.16.840.1.113730.4.1, 2.16.840.1.113733.1.8.1, 2.16.840.1.113733.1.8.1
  Fingerprint:
    32:f3:08:82:62:2b:87:cf:88:56:c6:3d:b8:73:df:08:53:b4:dd:27 (sha1)
    f9:1f:fe:e6:a3:6b:99:88:41:d4:67:dd:e5:f8:97:7a (md5)
  Auto-re-enrollment:
    Status: Disabled
    Next trigger time: Timer not started
Certificate identifier: G4
  Certificate version: 3
  Serial number: 513fb9743870b73440418d30930699ff
  Issuer:
    Organization: "VeriSign, Organizational unit: VeriSign Trust Network, Organizational unit: "(c) 2006 VeriSign, Country: US, Common name: VeriSign Class 3 Public Primary Certification Authority - G5
  Subject:
    Organization: Symantec Corporation, Organizational unit: Symantec Trust Network, Country: US, Common name: Symantec Class 3 Secure Server CA - G4
  Subject string:
    C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4
  Validity:
    Not before: 10-31-2013 00:00 UTC
    Not after: 10-30-2023 23:59 UTC
  Public key algorithm: rsaEncryption(2048 bits)
    30:82:01:0a:02:82:01:01:00:b2:d8:05:ca:1c:74:2d:b5:17:56:39
    c5:4a:52:09:96:e8:4b:d8:0c:f1:68:9f:9a:42:28:62:c3:a5:30:53
    7e:55:11:82:5b:03:7a:0d:2f:e1:79:04:c9:b4:96:77:19:81:01:94
    59:f9:bc:f7:7a:99:27:82:2d:b7:83:dd:5a:27:7f:b2:03:7a:9c:53
    25:e9:48:1f:46:4f:c8:9d:29:f8:be:79:56:f6:f7:fd:d9:3a:68:da
    8b:4b:82:33:41:12:c3:c8:3c:cc:d6:96:7a:84:21:1a:22:04:03:27
    17:8b:1c:68:61:93:0f:0e:51:80:33:1d:b4:b5:ce:eb:7e:d0:62:ac
    ee:b3:7b:01:74:ef:69:35:eb:ca:d5:3d:a9:ee:97:98:ca:8d:aa:44
    0e:25:99:4a:15:96:a4:ce:6d:02:54:1f:2a:6a:26:e2:06:3a:63:48
    ac:b4:4c:d1:75:93:50:ff:13:2f:d6:da:e1:c6:18:f5:9f:c9:25:5d
    f3:00:3a:de:26:4d:b4:29:09:cd:0f:3d:23:6f:16:4a:81:16:fb:f2
    83:10:c3:b8:d6:d8:55:32:3d:f1:bd:0f:bd:8c:52:95:4a:16:97:7a
    52:21:63:75:2f:16:f9:c4:66:be:f5:b5:09:d8:ff:27:00:cd:44:7c
    6f:4b:3f:b0:f7:02:03:01:00:01
  Signature algorithm: sha256WithRSAEncryption
  Distribution CRL:
    http://s1.symcb.com/pca3-g5.crl
  Use for key: CRL signing, Certificate signing
  Fingerprint:                        
    ff:67:36:7c:5c:d4:de:4a:e1:8b:cc:e1:d7:0f:da:bd:7c:86:61:35 (sha1)
    23:d5:85:8e:bc:89:86:10:7c:b7:ac:1e:17:f7:26:c5 (md5)
  Auto-re-enrollment:
    Status: Disabled
    Next trigger time: Timer not started

From output of show command, both certificates G4 and G5 at firewall fw-SRX1-2 look ok. But they wont pass verification.

root@fw-srx1-2> request security pki ca-certificate verify ca-profile G4
node1:
--------------------------------------------------------------------------
Error: Certificate Authority not found for certificate </C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5>
{primary:node1}
root@fw-srx1-2> request security pki ca-certificate verify ca-profile G5  
node1:
--------------------------------------------------------------------------
Error: Certificate Authority not found for certificate </C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5>

@SRX2, same thing happened:

root@fw-SRX2-1> show security pki ca-certificate detail 
node0:
--------------------------------------------------------------------------
Certificate identifier: G5
  Certificate version: 3
  Serial number: 250ce8e030612e9f2b89f7054d7cf8fd
  Issuer:
    Organization: "VeriSign, Organizational unit: Class 3 Public Primary Certification Authority, Country: US
  Subject:
    Organization: "VeriSign, Organizational unit: VeriSign Trust Network, Organizational unit: "(c) 2006 VeriSign, Country: US, Common name: VeriSign Class 3 Public Primary Certification Authority - G5
  Subject string:
    C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2006 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G5
  Validity:
    Not before: 11- 8-2006 00:00 UTC
    Not after: 11- 7-2021 23:59 UTC
  Public key algorithm: rsaEncryption(2048 bits)
    30:82:01:0a:02:82:01:01:00:af:24:08:08:29:7a:35:9e:60:0c:aa
    e7:4b:3b:4e:dc:7c:bc:3c:45:1c:bb:2b:e0:fe:29:02:f9:57:08:a3
    64:85:15:27:f5:f1:ad:c8:31:89:5d:22:e8:2a:aa:a6:42:b3:8f:f8
    b9:55:b7:b1:b7:4b:b3:fe:8f:7e:07:57:ec:ef:43:db:66:62:15:61
    cf:60:0d:a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:54:85
    26:e5:2b:8f:1b:9f:eb:f5:a1:91:c2:33:49:d8:43:63:6a:52:4b:d2
    8f:e8:70:51:4d:d1:89:69:7b:c7:70:f6:b3:dc:12:74:db:7b:5d:4b
    56:d3:96:bf:15:77:a1:b0:f4:a2:25:f2:af:1c:92:67:18:e5:f4:06
    04:ef:90:b9:e4:00:e4:dd:3a:b5:19:ff:02:ba:f4:3c:ee:e0:8b:eb
    37:8b:ec:f4:d7:ac:f2:f6:f0:3d:af:dd:75:91:33:19:1d:1c:40:cb
    74:24:19:21:93:d9:14:fe:ac:2a:52:c7:8f:d5:04:49:e4:8d:63:47
    88:3c:69:83:cb:fe:47:bd:2b:7e:4f:c5:95:ae:0e:9d:d4:d1:43:c0
    67:73:e3:14:08:7e:e5:3f:9f:73:b8:33:0a:cf:5d:3f:34:87:96:8a
    ee:53:e8:25:15:02:03:01:00:01
  Signature algorithm: sha1WithRSAEncryption
  Distribution CRL:
    http://crl.verisign.com/pca3.crl
  Use for key: CRL signing, Certificate signing, TLS Web Server Authentication, 1.3.6.1.5.5.7.3.1, TLS Web Client Authentication, 1.3.6.1.5.5.7.3.2, Code Signing, 1.3.6.1.5.5.7.3.3, Netscape Server Gated Crypto,
  2.16.840.1.113730.4.1, 2.16.840.1.113733.1.8.1, 2.16.840.1.113733.1.8.1
  Fingerprint:
    32:f3:08:82:62:2b:87:cf:88:56:c6:3d:b8:73:df:08:53:b4:dd:27 (sha1)
    f9:1f:fe:e6:a3:6b:99:88:41:d4:67:dd:e5:f8:97:7a (md5)
  Auto-re-enrollment:
    Status: Disabled
    Next trigger time: Timer not started
Certificate identifier: G4
  Certificate version: 3
  Serial number: 513fb9743870b73440418d30930699ff
  Issuer:
    Organization: "VeriSign, Organizational unit: VeriSign Trust Network, Organizational unit: "(c) 2006 VeriSign, Country: US, Common name: VeriSign Class 3 Public Primary Certification Authority - G5
  Subject:
    Organization: Symantec Corporation, Organizational unit: Symantec Trust Network, Country: US, Common name: Symantec Class 3 Secure Server CA - G4
  Subject string:
    C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4
  Validity:
    Not before: 10-31-2013 00:00 UTC
    Not after: 10-30-2023 23:59 UTC
  Public key algorithm: rsaEncryption(2048 bits)
    30:82:01:0a:02:82:01:01:00:b2:d8:05:ca:1c:74:2d:b5:17:56:39
    c5:4a:52:09:96:e8:4b:d8:0c:f1:68:9f:9a:42:28:62:c3:a5:30:53
    7e:55:11:82:5b:03:7a:0d:2f:e1:79:04:c9:b4:96:77:19:81:01:94
    59:f9:bc:f7:7a:99:27:82:2d:b7:83:dd:5a:27:7f:b2:03:7a:9c:53
    25:e9:48:1f:46:4f:c8:9d:29:f8:be:79:56:f6:f7:fd:d9:3a:68:da
    8b:4b:82:33:41:12:c3:c8:3c:cc:d6:96:7a:84:21:1a:22:04:03:27
    17:8b:1c:68:61:93:0f:0e:51:80:33:1d:b4:b5:ce:eb:7e:d0:62:ac
    ee:b3:7b:01:74:ef:69:35:eb:ca:d5:3d:a9:ee:97:98:ca:8d:aa:44
    0e:25:99:4a:15:96:a4:ce:6d:02:54:1f:2a:6a:26:e2:06:3a:63:48
    ac:b4:4c:d1:75:93:50:ff:13:2f:d6:da:e1:c6:18:f5:9f:c9:25:5d
    f3:00:3a:de:26:4d:b4:29:09:cd:0f:3d:23:6f:16:4a:81:16:fb:f2
    83:10:c3:b8:d6:d8:55:32:3d:f1:bd:0f:bd:8c:52:95:4a:16:97:7a
    52:21:63:75:2f:16:f9:c4:66:be:f5:b5:09:d8:ff:27:00:cd:44:7c
    6f:4b:3f:b0:f7:02:03:01:00:01
  Signature algorithm: sha256WithRSAEncryption
  Distribution CRL:
    http://s1.symcb.com/pca3-g5.crl
  Use for key: CRL signing, Certificate signing
  Fingerprint:                        
    ff:67:36:7c:5c:d4:de:4a:e1:8b:cc:e1:d7:0f:da:bd:7c:86:61:35 (sha1)
    23:d5:85:8e:bc:89:86:10:7c:b7:ac:1e:17:f7:26:c5 (md5)
  Auto-re-enrollment:
    Status: Disabled
    Next trigger time: Timer not started

Also the certificate chain did not pass verify procedure. The error is same as SRX1 device. It seems G5 CA certificate is having issue.

root@fw-SRX2-1> request security pki ca-certificate verify ca-profile G4  
node0:
--------------------------------------------------------------------------
CA certificate G4 verified successfully
{primary:node0}
root@fw-SRX2-1> request security pki ca-certificate verify ca-profile G5  
node0:
--------------------------------------------------------------------------
Error: Certificate Authority not found for certificate </C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5>

Both Devices CA certificate chain did not pass the verify. On SRX1, G4 and G5 CA certificate did not pass verify, and on SRX2, only G5 failed, although I imported same certificates on both devices.

Troubleshooting:

Let have a look at the files we got from Symantec Verisign:

1. ssl_certificate.crt is firewall's  certificate which is signed by Verisign CA certificate.

2. IntermediateCA.crt is CA certificate chain file which includes two certificates.

-----BEGIN CERTIFICATE-----MIIFODCCBCCgAwIBAgIQUT+5dDhwtzRAQY0wkwaZ/zANBgkqhkiG9w0BAQsFADCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwHhcNMTMxMDMxMDAwMDAwWhcNMjMxMDMwMjM1OTU5WjB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAstgFyhx0LbUXVjnFSlIJluhL2AzxaJ+aQihiw6UwU35VEYJbA3oNL+F5BMm0lncZgQGUWfm893qZJ4Itt4PdWid/sgN6nFMl6UgfRk/InSn4vnlW9vf92Tpo2otLgjNBEsPIPMzWlnqEIRoiBAMnF4scaGGTDw5RgDMdtLXO637QYqzus3sBdO9pNevK1T2p7peYyo2qRA4lmUoVlqTObQJUHypqJuIGOmNIrLRM0XWTUP8TL9ba4cYY9Z/JJV3zADreJk20KQnNDz0jbxZKgRb78oMQw7jW2FUyPfG9D72MUpVKFpd6UiFjdS8W+cRmvvW1Cdj/JwDNRHxvSz+w9wIDAQABo4IBYzCCAV8wEgYDVR0TAQH/BAgwBgEB/wIBADAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vczEuc3ltY2IuY29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB/wQEAwIBBjAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zMi5zeW1jYi5jb20wawYDVR0gBGQwYjBgBgpghkgBhvhFAQc2MFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0xLTUzNDAdBgNVHQ4EFgQUX2DPYZBV34RDFIpgKrL1evRDGO8wHwYDVR0jBBgwFoAUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwDQYJKoZIhvcNAQELBQADggEBAF6UVkndji1l9cE2UbYD49qecxnyH1mrWH5sJgUs+oHXXCMXIiw3k/eG7IXmsKP9H+IyqEVv4dn7ua/ScKAyQmW/hP4WKo8/xabWo5N9Q+l0IZE1KPRj6S7t9/Vcf0uatSDpCr3gRRAMFJSaXaXjS5HoJJtGQGX0InLNmfiIEfXzf+YzguaoxX7+0AjiJVgIcWjmzaLmFN5OUiQt/eV5E1PnXi8tTRttQBVSK/eHiXgSgW7ZTaoteNTCLD0IX4eRnh8OsN4wUmSGiaqdZpwOdgyA8nTYKvi4Os7X1g8RvmurFPW9QaAiY4nxug9vKWNmLT+sjHLF+8fk1A/yO0+MKcc=-----END CERTIFICATE----------BEGIN CERTIFICATE-----MIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ/XxrcgxiV0i6CqqpkKzj/i5Vbext0uz/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4/VBEnkjWNHiDxpg8v+R70rfk/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3/-----END CERTIFICATE-----

After saved each part of certificate chain into a file, I checked the certificate property for each certificate.

From the certificate properties, we can tell "Symantec Class 3 Secure Server CA - G4" is signed by "VeriSign Class 3 Public Primary Certification Authority - G5" and "VeriSign Class 3 Public Primary Certification Authority - G5" is signed by "Class 3 Public Primary Certification Authority"

From below output, local certificate SRX1 is signed by "Symantec Class 3 Secure Server CA - G4"

root@fw-SRX1-1> show security pki local-certificate detail
node0:
--------------------------------------------------------------------------
Certificate identifier: SRX1
  Certificate version: 3
  Serial number: 2d6f03041e93e1e97acd758ae940e6db
  Issuer:
    Organization: Symantec Corporation, Organizational unit: Symantec Trust Network, Country: US, Common name: Symantec Class 3 Secure Server CA - G4
  Subject:
    Organization: GG, Organizational unit: IT, Country: CA, State: Ontario, Locality: srx1, Common name: srx1.gg.com
  Subject string:
    C=CA, ST=Ontario, L=srx1, O=gg, OU=IT, CN=srx1.gg.com
  Alternate subject: email empty, srx1.gg.com, ip empty
  Validity:
    Not before: 01- 9-2015 00:00 UTC
    Not after: 04- 5-2018 23:59 UTC
  Public key algorithm: rsaEncryption(2048 bits)
    30:82:01:0a:02:82:01:01:00:9d:96:c7:76:c3:66:25:c3:ec:58:61
    ee:c9:9d:82:ae:d6:de:26:ff:50:e8:b1:a0:ce:cd:0f:1a:f2:59:56
    9f:7f:49:aa:de:88:a8:5d:4c:69:0a:5b:f0:91:a7:49:e4:9b:3b:df
    e4:0e:24:7d:23:fe:32:4b:c0:9e:a6:37:ff:0c:7b:ae:02:6b:1c:b7
    7c:79:29:e3:73:4d:4f:3d:5a:38:4a:f6:43:03:8b:b9:8e:19:ea:bb
    cd:52:00:5d:a8:b5:a8:3a:92:3c:38:06:13:32:50:56:31:3f:be:68
    a2:b7:e4:f0:2d:0c:a2:f1:0b:22:b3:ea:2a:9e:47:7b:5b:aa:cc:43
    9d:f2:4e:e5:86:9f:c8:37:fc:02:d4:66:34:93:e0:d6:6b:35:c9:5d
    25:29:90:6d:ab:8c:1e:00:a1:cb:79:27:b4:f9:26:2e:e4:22:20:28
    70:e1:51:b6:7d:4a:34:07:c9:a3:69:49:26:34:6a:0b:66:ee:0c:29
    a5:c6:14:04:fb:64:49:31:72:cb:10:15:c4:c4:2b:66:b3:8c:3d:21
    76:34:3d:6a:83:0b:50:92:fe:32:a4:0c:7b:d2:82:d2:3f:61:63:59
    8c:57:4b:c7:99:09:a0:57:45:6c:e9:fb:64:34:80:46:dc:43:ce:4d
    1b:d0:d9:0a:e3:02:03:01:00:01
  Signature algorithm: sha256WithRSAEncryption
  Distribution CRL:
    http://ss.symcb.com/ss.crl
  Use for key: Key encipherment, Digital signature, TLS Web Server Authentication, 1.3.6.1.5.5.7.3.1, TLS Web Client Authentication, 1.3.6.1.5.5.7.3.2
  Fingerprint:
    8a:ea:0d:e2:a9:28:65:d1:d4:e0:6d:77:7e:aa:75:7d:69:7d:1f:ab (sha1)
    c7:b2:a1:ad:36:aa:8e:40:3d:5e:c9:cb:ad:9b:3f:10 (md5)
  Auto-re-enrollment:
    Status: Disabled
    Next trigger time: Timer not started

I checked the Symantec page "Licensing and Use of Root Certificates", and found there is another G5 certificate.

Downloaded it and checked the property from Windows:

This new G5 certificate will expire on 2036 and has same Issued to and Issued by, which means it is Root CA certificate. The old G5 will expire on 2021 and have different Issued to and Issued by , which means it is signed by another root CA certificate. Now I am kind of understand Symantec Certificate Chain by drawing following diagram:

Solutions:

Now it is quite clear, with those originate certificates sent from Symantec, I only have G5(2021) and G4 for CA certificate chain. I am missing one root certificate "Verisign Class 3 Public Primary CA".

I can either import another new ca certificate to complete this chain, or replace G5(2021) with the new G5(2036). I choose replace option.

All steps are listed in the following:

root@fw-SRX1-2> request security pki ca-certificate load ca-profile G5 filename /var/tmp/G5.pem  
node1:
--------------------------------------------------------------------------
error: Command aborted as CA certificate already exists. Retry after clearing the existing CA certificate

root@fw-SRX1-2> clear security pki ca-certificate ca-profile G5                                  

root@fw-SRX1-2> request security pki ca-certificate load ca-profile G5 filename /var/tmp/G5.pem  
node1:
--------------------------------------------------------------------------
Fingerprint:
  4e:b6:d5:78:49:9b:1c:cf:5f:58:1e:ad:56:be:3d:9b:67:44:a5:e5 (sha1)
  cb:17:e4:31:67:3e:e2:09:fe:45:57:93:f3:0a:fa:1c (md5)
CA certificate for profile G5 loaded successfully
root@fw-SRX1-2> request security pki ca-certificate verify ca-profile G4
node1:
--------------------------------------------------------------------------
CA certificate G4 verified successfully

root@fw-SRX1-2> request security pki ca-certificate verify ca-profile G5  
node1:
--------------------------------------------------------------------------
CA certificate G5 verified successfully

root@fw-SRX1-2> show security pki ca-certificate node0:--------------------------------------------------------------------------
Certificate identifier: G5  Issued to: VeriSign Class 3 Public Primary Certification Authority - G5, Issued by: C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5  Validity:    Not before: 11- 8-2006 00:00 UTC    Not after: 07-16-2036 23:59 UTC  Public key algorithm: rsaEncryption(2048 bits)
Certificate identifier: G4  Issued to: Symantec Class 3 Secure Server CA - G4, Issued by: C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5  Validity:    Not before: 10-31-2013 00:00 UTC    Not after: 10-30-2023 23:59 UTC  Public key algorithm: rsaEncryption(2048 bits)

Verify:

Check IKE and IPSec SA Staus

root@fw-SRX1-2> show security ike security-associations
node1:
--------------------------------------------------------------------------
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address
301675926 UP   a148a554596bf461  cc586e1ce0d381be  Main           10.9.1.1    
{secondary:node0}
root@fw-SRX1-2> show security ipsec security-associations
node1:
--------------------------------------------------------------------------
  Total active tunnels: 1
  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway
  <131073 ESP:aes-cbc-128/sha1 c2a9ad05 1690/ unlim - root 500 10.9.1.1    
  >131073 ESP:aes-cbc-128/sha1 3fd4eedc 1690/ unlim - root 500 10.9.1.1     

Configuration:

Interfaces {
    st0 {
        unit 0 {
            family inet;
        }
    }
}

admin@fw-trn1-2> show configuration routing-instances 
vr_SRX2{
    instance-type virtual-router;
    interface reth9.0;
    interface st0.0;
    routing-options {
        static {
            route 1.1.1.0/24 next-hop 10.4.1.2;
            route 10.9.0.0/16 next-hop st0.0;
            route 10.9.1.1/32 next-hop 10.4.1.2;
        }
        aggregate {
            route 10.94.0.0/16 {
                preference 2;
            }
            route 192.168.0.0/16 {
                preference 2;
            }
        }
        instance-import from_all_to_SRXl;
    }
}

pki {

    ca-profile G4 {
        ca-identity test.com;
        revocation-check {
            disable;
        }
        administrator {
            email-address "test1@test.com";
        }
    }
    ca-profile G5 {
        ca-identity test.com;
        revocation-check {
            disable;
        }
        administrator {
            email-address "test1.test.com";
        }
    }
    traceoptions {
        file PKITRACE size 1m;
        flag all;
    }
}

ike {

    inactive: traceoptions {
        file IKELOG size 1m;
        flag policy-manager;
        flag ike;
        flag routing-socket;
        flag certificates;
    }
    proposal P1-AES_1_1 {
        authentication-method rsa-signatures;
        dh-group group2;
        authentication-algorithm sha1;
        encryption-algorithm aes-128-cbc;
        lifetime-seconds 86400;
    }
    policy ike-pol-Myvpn {
        mode main;
        proposals P1-AES_1_1;
        certificate {
            local-certificate SRX1;
            peer-certificate-type x509-signature;
        }
        inactive: pre-shared-key ascii-text "$9$4xZGjqmT3nCHqp01IcSs2g4Uj"; ## SECRET-DATA
    }
    gateway gw-TheirGateway {
        ike-policy ike-pol-Myvpn;
        address 10.9.1.1;
        local-identity hostname srx1.test.com;
        remote-identity hostname srx2.test.com;
        external-interface reth9.0;
        local-address 10.4.1.1;
    }
}

ipsec {

    proposal P2-AES_1 {
        description group2;
        protocol esp;
        authentication-algorithm hmac-sha1-96;
        encryption-algorithm aes-128-cbc;
        lifetime-seconds 3600;
    }
    policy ipsec-pol-1 {
        perfect-forward-secrecy {
            keys group2;
        }
        proposals P2-AES_1;
    }
    vpn vpn-ToThem {
        bind-interface st0.0;
        ike {
            gateway gw-TheirGateway;
            idle-time 1800;
            ipsec-policy ipsec-pol-1;
        }
    }
}

Bridge Your Home Routers to Extend Your Wireless Network

Not sure how many home users are experiencing wireless router coverage issue. Your wireless home router is set at living room, but at the certain location of your home, the wireless signal is quite weak. It will be painful especially when you found this fact on the bed with your tablet devices. Upgrade a more powerful wireless routers, or buy another router repeater?Actually the router vendors have implemented a "bridge" technology which can enable wireless connection between multi-vendor's routers. Here is Wikepedia's explanation about Bridging (networking):

"Network bridging is the action taken by network equipment to create an aggregate network from either two or more communication networks, or two or more network segments. If one or more segments of the bridged network are wireless, it is known as wireless bridging. Bridging is distinct from routing, which allows multiple different networks to communicate independently while remaining separate."

This post is my weekend task to get my living room's wireless signal to cover the corner of my bed room better. In the bedroom's far end from wireless router's location, the signal is always not enough to keep my ipad/cell phone persistently connected. To stop my family's complain, I decided to set up secondary router as a bridge Access Point at second floor, which will provide strong signal to upper floors.

Topology:

1. Main Router's Configuration

Main router is from isp, and this Adsl device model is HG-A800. This router's configuration is not any special. You just need to enable wireless security, LAN network and DHCP. 

Wireless basic configuration:

Note: Channel should not be set to Auto since it may change after a reboot or power outage. After you find out current channel number such as 6 in this example, you will need to set it as current channel. Your bridge channel will be set it to same number manually. That will prevent lost connection between two routers. (updated Jul 12 2017)

 Wireless Security:

 LAN and DHCP Setup (LAN IP is 192.168.2.1):

2. Secondary Router's Configuration:

TP-LINK WR941ND is used as secondary router for bridge Access Point purpose. 

There is no connection on WAN port since it is secondary router which is not directly connecting to Internet. LAN port can be used to connect local network devices such as media player, game console or desktop.WAN configuration type for this secondary router will be Dynamic IP. LAN IP will be 192.168.2.2. DHCP Scope is from 192.168.2.151 to 192.168.2.199. As you tell, The DHCP Scope of Primary router and Secondary router is not overlapping, which is easier for us to identify which device your system is logged in by wireless later. 

The most important part is Wireless Settings in secondary router. You had better set up same wireless SSID and password  as Primary router, especially at SSID (to be bridged) section. 

Note. As you can see the channel is manually set to 6 to match your main router. 

3. Test Result

My ISP is providing 15 mbps downloading speed and 1 mbps uploading speed. From the speedtest.net's result, it shows pretty good result from Secondary router, almost no loss from this set up.

Excel Formula: Search a Column of Strings to Match Another Column

Once a while, I have to work on Excel sheet manually. Today I have to search exported hundreds of ip addresses in a pre-defined excel spreadsheet to see if there is a match. It seems a easy work, but it took me almost an hour to find right formula.

Column O includes all exported ip addresses. I have to manually search if those column O's ip addresses are appearing in column B's text. If yes, which row is it?

Formula is set at Column N.

=MATCH("*"&(O6)&"*",B:B,0)

As you can see from cell N6, the number is 7, which means the text in B7 includes O6's string.
N12's number is 5, which means the test in B5 includes O12's string. 

Using PRTG SNMPv3 Monitoring Juniper SRX 240H Alarm andTemperature

One of our SRX240H is having temperature problem. Whenever the temperature reached 50 Celsius degree, system alarm will be on. Alarm email should be sent out when temperature reached threshold 50. SRX itself seems not able to send alarm email out based on this discussion. NSM or other SNMP tools may help in this situation.

PRTG is using to monitor our network devices and it works great with SNMPv3. My previous post has described how to monitor SRX's CPU, Memory, Flow Sessions etc. Alarm status and Temperature is another sensor I am looking for to monitor. There are couple of ways to do it. You can use NSM to send alarm email, firewall itself to send snmp traps to your SNMP server, or Network Monitoring Tools to pull SNMP OID values then send email. In my case, PRTG is preferred way to monitor system status and send alarming email based on the requirement.

Step 1: SNMPv3 on SRX

set snmp v3 usm local-engine user SRXAES authentication-md5 authentication-password Test1234
set snmp v3 usm local-engine user SRXAES privacy-aes128 privacy-password Test12345
set snmp engine-id local 4716
set snmp view view_all oid 1 include
set snmp filter-duplicates
set snmp health-monitor

set snmp location "<location>"
set snmp contact "<contact name>"
set snmp community <community-name> authorization read-only
set snmp community <community-name> clients <snmp-host>
set snmp community <community-name> clients 0.0.0.0/0 restrict

Note: A generic local engine-id must be configured. Otherwise (e.g. when the MAC is used) SNMPv3 will not work in cluster configurations. After configuring the engine-id, committing the configuration might be required because the engine-id is involved in the key generation below.

To make NSM work with SRX, location and contact should not be set. Else, after the configuration imported into NSM, when you push policy from NSM to SRX, snmpv3 anthentication password and privacy password will be changed.

In my working configuration for NSM and SRX 240H / 1400 Cluster, the configuration looks like below:

root@fw-srx-1> show configuration snmp
v3 {
    usm {
        local-engine {
            user SRXAES {
                authentication-md5 {
                    authentication-key "$9$cOJSKMWLxNbs8LUjq.zF9ApuIEM8Xx-VvM4aJGq.Tz390BhSrlM836evW8dVP5TCuO1EhrOB-VYgJZ69CApBlKM-bsKv4aZUHkBIRcevdbsY4aSr8boa/CAtu1SyKW87vMX-bs4oJGDk5Q9ApREyk.hSreXxk5Qn/9pOBE3nA0O1hcYg4oDi"; ## SECRET-DATA
                }
                privacy-aes128 {
                    privacy-key "$9$4yaZjq.53/CmPF/CtIRNdVsoJDik.mTZGp01IcSM8XNds4oGDHqvWUjqmTQevM8dbYgojk.4oz369OBX7N-s2JZjPfz.muOBIrlLxNdVYgoDkY2QF6/tpM8Lx7VY2aGjHaJUH.PQzEcSl8XVwYaGDsYoGiH5T369pIErev7dbuONdbYoan/9AtO"; ## SECRET-DATA
                }
            }
        }
    }
    vacm {
        security-to-group {
            security-model usm {
                security-name SRXAES {
                    group readonly;
                }
            }
        }
        access {
            group readonly {
                default-context-prefix {
                    security-model usm {
                        security-level privacy {
                            read-view view_all;
                        }
                    }
                }
            }
        }
    }
}
engine-id {
    local 109849;
}
view view_all {
    oid 1 include;
}
client-list snmpclient {
    10.1.1.11/31;
    0.0.0.0/0 {
        restrict;
    }
}

Step 2: PRTG Configuration

PRTG can be easily integrated into your network monitoring system and execute comprehensive monitoring tasks. Also , alerting feature is quite flexible to meet your organization needs. Even one normal windows server can monitoring thousands of sensors without problem.

For SNMPv3 configuration in the PRTG, right click edit pop up menu at  root properties of Device tab, enter the snmpv3 information:

Then you can add your network devices with inherited configuration. All new device will get same snmpv3 configuration.

Step 3: Add SNMP Custom Sensor

Following instruction on the screen to add sensor for your network devices, you will need to pick SNMP category's SNMP Custom type sensor.

In the basic sensor settings, the most important thing is OID values. You will need to know exact OID number to make your own monitoring sensor in the PRTG.

Lets go back to our SRX firewall to find out what the temperature SNMP mib oid is:

Show snmp mib walk 1.3.6.1.4.1 | match temp

we are able to find out a couple of values for temperature:

jnxOperatingTemp.9.1.0.0 = 50
jnxOperatingTemp.9.2.0.0 = 49
jnxFruTemp.9.1.0.0 = 50
jnxFruTemp.9.1.1.0 = 50
jnxFruTemp.9.2.0.0 = 48
jnxFruTemp.9.2.1.0 = 48

From Show Chassis Routing-Engine, there are different type of temperature for cpu and chassis , also for different node if it is cluster configuration.

root@fw-srx-1> show chassis routing-engine
node0:
--------------------------------------------------------------------------
Routing Engine status:
    Temperature                 50 degrees C / 122 degrees F
    CPU temperature             49 degrees C / 120 degrees F
    Total memory              1024 MB Max   850 MB used ( 83 percent)
      Control plane memory     560 MB Max   493 MB used ( 88 percent)
      Data plane memory        464 MB Max   362 MB used ( 78 percent)
    CPU utilization:
      User                       7 percent
      Background                 0 percent
      Kernel                     5 percent
      Interrupt                  0 percent
      Idle                      87 percent
    Model                          RE-SRX240H
    Serial ID                      AAEP4868
    Start time                     2015-01-18 13:24:42 UTC
    Uptime                         38 days, 8 hours, 29 minutes, 47 seconds
    Last reboot reason             0x200:normal shutdown
    Load averages:                 1 minute   5 minute  15 minute
                                       0.16       0.44       0.46
node1:
--------------------------------------------------------------------------
Routing Engine status:
    Temperature                 48 degrees C / 118 degrees F
    CPU temperature             50 degrees C / 122 degrees F
    Total memory              1024 MB Max   696 MB used ( 68 percent)
      Control plane memory     560 MB Max   336 MB used ( 60 percent)
      Data plane memory        464 MB Max   357 MB used ( 77 percent)
    CPU utilization:
      User                       5 percent
      Background                 0 percent
      Kernel                     3 percent
      Interrupt                  0 percent
      Idle                      92 percent
    Model                          RE-SRX240H
    Serial ID                      AAEK3334
    Start time                     2015-02-15 16:05:14 UTC
    Uptime                         10 days, 5 hours, 49 minutes, 24 seconds
    Last reboot reason             0x200:normal shutdown
    Load averages:                 1 minute   5 minute  15 minute
                                       0.06       0.08       0.08

Next step is to find out OID from online website OID database , such as http://oid-info.com/ or Solarwinds SNMP Center:
From the database search result, it shows jnxOperatingTemp = 1.3.6.1.4.1.2636.3.1.13.1.7
In this case, jnxOperatingTemp.9.2.0.0 is 1.3.6.1.4.1.2636.3.1.13.1.7.9.2.0.0. That is exactly OID we need for this monitoring. 

Step 4. Create email alarm

After checked the thresholds for temperature as shown in below, we will build an alarm email.

root@fw-srx-1> show chassis temperature-thresholds
node0:
--------------------------------------------------------------------------
                           Fan speed      Yellow alarm      Red alarm      Fire Shutdown
                          (degrees C)      (degrees C)     (degrees C)      (degrees C)
Item                     Normal  High   Normal  Bad fan   Normal  Bad fan     Normal
Chassis default              35    45       50       40       75       65      100
Routing Engine               35    45       50       40       75       65      100
node1:
--------------------------------------------------------------------------
                           Fan speed      Yellow alarm      Red alarm      Fire Shutdown
                          (degrees C)      (degrees C)     (degrees C)      (degrees C)
Item                     Normal  High   Normal  Bad fan   Normal  Bad fan     Normal
Chassis default              35    45       50       40       75       65      100
Routing Engine               35    45       50       40       75       65      100

Based on this Object Triggers set up, once the JnxOperatingTemp sensor's value is above 51 for 60 seconds, an email will be sent out to admin.

Reference:

• Junos temperature thresholds in SRX devices and the actions taken when it exceeds the threshold
• Monitoring Juniper SRX Firewall CPU, Memory and Flow Session Information from PRTG
• How can I use a trusted SSL certificate with the PRTG web interface?

A Quick Test to Check Point Capsule Cloud Service

Not sure how many Checkpoint customers are using this service, but it is quite attractive when I heard about it. It will help your remote users connect with your global offices and Internet seamlessly.  

Roaming users will use a vpn tunnel to connect to Check Point's cloud network, from there they could access their company's Internal network with another pre-built vpn tunnel. Also from Check Point Cloud, roaming users will be able to browse Internet safely with Check Point's cloud service:

• URL Filtering
• Anti-Virus
• Anti-Bot
• Threat Emulation
• IPS
• HTTPS Inspection

Lets start to experience it:

Step 1: Register an account at https://cloud.checkpoint.com/ with your email account

 After registration, you will receive a email with subject "Your Capsule Connect registration code". Inside the email, there are all links to download the client for Windows, Macintosh, Android and iOS versions.

Step 2: Download and Install the Client:

From "Your Capsule Connect registration code" email, download windows client on your pc. Double click and follow on screen instruction to complete software installation. You will find a cloud icon appears on your right bottom screen. Basically the client will install a new Local Area Connection network driver "Check Point Virtual Network Adapter For Cloud Connect" in your system.

Right click the cloud icon:

Select 'Show Client' menu to enable main window. Choose connect button to make a connection to Check Point's Cloud network.

After system connected to the cloud, you will find your system got a new ip address (172.16.9.28/22) from DHCP server 172.16.9.27 with DNS server 8.8.8.8.

Also from Speedtest.net, we will see the system got an US ip address 208.43.242.98. The download and upload speed is not that bad. 

My pc is having almost 100Mbps download / upload speed without connecting to Checkpoint Cloud.

Step 3: Log into https://cloud.checkpoint.com/ to review the configuration and policies

Check Point Capsule Cloud Policy Tab.
Under Security Policy, there are three features enabled:

• URL Filtering
• Threat Prevention
• HTTPS Inspection

Step 4: Troubleshooting for https website issue

By default, there is a problem to browse https website, such as Gmail site.It shows a This Connection is Untrusted and the connection is blocked. 

From the "Logs & Reports" tab, it shows Check Point Cloud Service Application Cloud blade blocked those 

Double click the log entry you will get the log details for that record.

After turned off HTTPS Inspection from Policy tab, those https website become available again. 

Reference:

• Check Point Capsule Cloud sk102501
• Check Point Capsule Cloud Administration Guide