topic Disabling Weak Ciphers (Specifically DES) for IPSEC on R80.30 and R80.40 in Firewall and Security Management

Disabling Weak Ciphers (Specifically DES) for IPSEC on R80.30 and R80.40

johnnyringo — Tue, 06 Apr 2021 22:38:38 GMT

A new R80.30 cluster has been flagged by Qualys as supporting "Weak IPSec Encryption Settings". I assumed this was over SHA-1 or 1024-bit keys, but got a bit of a surprise when I viewed the report and saw that it was complaining of DES. Like RC4 and MD5, DES has been obsolete for about 20 years and there's absolutely no reason to have it enabled or even supported for that matter.

But, how do I disable it? It's not clear to me if unchecking it in traditional mode is adequate, or I should be looking somewhere else.

Re: Disabling Weak Ciphers (Specifically DES) for IPSEC on R80.30 and R80.40

PhoneBoy — Wed, 07 Apr 2021 02:30:18 GMT

https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk82900

Re: Disabling Weak Ciphers (Specifically DES) for IPSEC on R80.30 and R80.40

johnnyringo — Wed, 07 Apr 2021 04:20:54 GMT

Thanks. The steps left me a bit confused because we're not configuring VPNs via Traditional Mode (which is the default) and this is a fresh policy created in R80.30. Also, we don't use Remote Access VPN. But I'll give that a shot and ask for a re-scan.