topic Re: issue with IKE weak negotiations on R80.20 in Firewall and Security Management

issue with IKE weak negotiations on R80.20

carl_t — Tue, 10 Sep 2019 14:52:45 GMT

Hi All

Can anyone shed any light for us, we have regular pen tests from our partner, we have a firewall that they say is responding to weak IKE transformations.

We have IKEv2 enabled on this said firewall using AES256 and SHA256 but they still say its weak.

Other firewalls are configured the same but don't have any issues.

Any ideas?

Re: issue with IKE weak negotiations on R80.20

PhoneBoy — Tue, 10 Sep 2019 23:03:43 GMT

Specifically, which ciphers do they claim is being offered?

Re: issue with IKE weak negotiations on R80.20

Timothy_Hall — Sun, 15 Sep 2019 19:07:57 GMT

The go-to SK for audit scan results is this one: sk100647: Check Point response to common false positives scanning results

Could this be what they are referring to specifically for IKE, which doesn't apply to Check Point firewalls anyway: sk134572: Check Point response to Bleichenbacher oracle cryptographic attack (IKEv1/IKEv2)