OCSP Server Not Contacted by FortiGate

[AtiT]

Hi,

I have a FortiGate 80D on v5.2.8 and FortiAuthenticator (trial) on v4.1.1 (v4.00-build0081).

I have a local user on the FAC and is authenticated via RADIUS from the FortiGate - that's working.

I set up CA, SCEP, Device Certificate Enrollment, User self-registration etc. and everything is working.

Now I want to use online certificate revocation checking - according to FAC document it should be done via SCEP on port 2560.

The settings on the FortiGate:

# show vpn certificate ocsp-server config vpn certificate ocsp-server     edit "fac_ocsp"         set url "http://192.168.231.3:2560"         set cert "REMOTE_Cert_1"     next end

When I connect with the FortiClient using username/password and certificate the CRL via SCEP is not checked. I cannot see any communication from the FortiGate to FortiAuthenticator on port 2560.

When I try telnet from FortiGate it seems to be working:

# execute telnet 192.168.231.3 2560 Trying 192.168.231.3... Connected to 192.168.231.3. HTTP/1.0 200 OK Content-Type: application/ocsp-response Content-Transfer-Encoding: Binary Content-Length: 5 Date: Jul 26 13:54:03 2016 GMT Expires: Jul 26 13:59:03 2016 GMT 0 Connection closed by foreign host.

Why the FortiGate is not checking the revocation status? Some other configuration is needed or is it a bug?

[Jeff_FTNT]

Please check setting :

config vpn certificate setting     set ocsp-status disable     set ocsp-default-server ''     set check-ca-cert enable     set strict-crl-check disable     set strict-ocsp-check disable end

[AtiT]

Hello Jeff,

Thank you for these settings I missed them.

I set the following:

# show vpn certificate setting config vpn certificate setting     set ocsp-status enable     set ocsp-default-server "fac_ocsp"     set strict-crl-check enable     set strict-ocsp-check enable end

However the FGT is still not contacted the FAC for CRL. Also the fnband debug does not show the CRL checking:

# diagnose debug application fnbamd -1 # diagnose debug enable fnbamd_fsm.c[2146] handle_req-Rcvd auth_cert req id=226456370 fnbamd_auth.c[1308] check_cert-CA found: CA_Cert_5

------ here should be the CRL check status ------------ fnbamd_auth.c[1608] cert_check_group_list-group list is null fnbamd_comm.c[169] fnbamd_comm_send_result-Sending result 0 for req 226456370 fnbamd_fsm.c[1891] handle_req-Rcvd auth req 226456371 for ta in RadiusGroup opt=00000100 prot=10 fnbamd_fsm.c[336] __compose_group_list_from_req-Group 'RadiusGroup'

When I import the CRL manually into the FGT the CRL is checked:

fnbamd_fsm.c[2146] handle_req-Rcvd auth_cert req id=226456316 fnbamd_auth.c[1308] check_cert-CA found: CA_Cert_5 fnbamd_auth.c[1688] check_crl-CRL found: CRL_2 fnbamd_auth.c[1608] cert_check_group_list-group list is null fnbamd_comm.c[169] fnbamd_comm_send_result-Sending result 0 for req 226456316 fnbamd_fsm.c[1891] handle_req-Rcvd auth req 226456317 for attilatoth in RadiusGroup opt=00000100 prot=10 fnbamd_fsm.c[336] __compose_group_list_from_req-Group 'RadiusGroup'

Should I open a support ticket for this?

[Jeff_FTNT]

Hi AtiT,

You may open a support ticket.

Normally FGT Dialup VPN check certificate from FortiClient  with "set peertype  peer/peergrp" in Phase1 setting, thanks.

[Alpha7]

Hi AtiT

Did you make this work?

Thanks

[AtiT]

Hello.

I had a support ticket open with Fortinet. The result was that it is a bug and should be fixed in the 5.6 GA release.

I did not tested this behaviour yet.

What we are using in most cases is Windows OCSP running on Windows Server and peer users that has only certificate authentication. This is working.

[Fishbone_FTNT]

Hi AtiT,

you can also use ocsp-server-override in the peer config. I guess if you specifically name in the peer, it might work.

Fishbone)(

[bommi]

AtiT wrote:

Hello.

I had a support ticket open with Fortinet. The result was that it is a bug and should be fixed in the 5.6 GA release.

I did not tested this behaviour yet.

What we are using in most cases is Windows OCSP running on Windows Server and peer users that has only certificate authentication. This is working.

Hi,

did you get an official bug id for this?

Regards

bommi