This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSec between XG125 and Cisco ASA with Digital Certificates Problem

Hi,

i´ve tried to establish a connection to HeadOffice with Digital Certificates (CSR -> CA/Cert).

IPSec Profile seems to be correct but when i try to establish the connection the ipsec logs say:

If i add the correct Remote-ID like /C=bla/O=blabla/OU=blabla/CN=blabla/unstructuredName=blabla it says i can save the config but can not activate:

IPsec Log says:

bad right --id: unknown OID in ID_DER_ASN1_DN (ignored)

But when i change the Remote-ID or delete the unstructuredName Attribute i can activate the connection but i will get this error message after trying to establish it:

..........

Any Ideas?

This thread was automatically locked due to age.

0 lferrara over 8 years ago

Andreas,

Did you upload the proper CA on XG and the cA used to sign XG certificate and certificate on the other firewall?

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Andreas Hiermer over 8 years ago in reply to lferrara

Hi, i´ve access to the sophos xg device not to the cisco. After i have sent the csr to the official root CA i received the the root ca/identity cert (pem). I´ve uploaded the proper root CA on XG and I´ve uploaded the Identity Certificate on XG. That´s what i´ve done.

Did i overlooked something?
Cancel
Vote Up 0 Vote Down

Cancel
0 Aditya Patel over 8 years ago in reply to Andreas Hiermer

HI Andreas ,

Could you DM us the certificate used , along with the link to this thread as a reference . We would like to check and test the certificate .
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 8 years ago in reply to Andreas Hiermer

Andreas,

I suggest you this KB on how S2S vpn using certificates work!

https://community.sophos.com/kb/en-us/123138

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Andreas Hiermer over 8 years ago in reply to lferrara

Thank you for the link. I´ve read the KB article about 10times^^

I´ve opened a ticket with Sophos Support tool.
Cancel
Vote Up 0 Vote Down

Cancel