How to move to a new RSA ACE server
When moving a Security Gateway that has already been configured to use an RSA server for SecurID authentication. It is recommended that you logon to the Security Gateway and clear the content of the /var/ace/ directory.
The reason this needs to be done is because when Check Point Management server applies the new sdconf.rec & sdopts.rec files to the /var/ace/ directory is does not remove the existing shared secret. This means that the gateway uses the existing "old" shared secret with the new RSA server rather than renegotiate a new shared key with the new RSA server. Because the shared secrets are not the same, the authentication process to fail.
Original Files cp-fw[root]# ls -ll /var/ace/ total 10 -rw-rw---- 1 root wheel 1024 Nov 25 10:08 sdconf.rec -rw-rw---- 1 root wheel 23 Nov 21 2011 sdopts.rec -rw-rw---- 1 root wheel 2418 Nov 25 09:26 sdstatus.12 -r-------- 1 root wheel 512 Nov 21 2011 securid
Remove the files from the /var/ace/ directory
cp-fw[root]# cd /var.ace cp-fw[root]# rm *.* cp-fw[root]# ls -ll total 0
Once all file have been removed from the /var/ace folder push the updated policy to the security gateway.
After Policy Installation cp-fw[root]# ls -ll /var/ace/ total 4 -rw-rw---- 1 root wheel 1024 Dec 11 15:51 sdconf.rec -rw-rw---- 1 root wheel 0 Dec 11 15:49 sdopts.rec
Initiate a VPN to the Security Gateway and try to authenticate a user. After you have successful authenticated a user check the /var/ace/ directory again to ensure all the.
After Successful Authentication cp-fw[root]# ls -ll /var/ace/ total 10 -rw-rw---- 1 root wheel 1024 Dec 11 15:51 sdconf.rec -rw-rw---- 1 root wheel 0 Dec 11 15:49 sdopts.rec -rw-rw---- 1 root wheel 2418 Dec 11 15:53 sdstatus.12 -r-------- 1 root wheel 512 Dec 11 15:53 securid