topic Re: TLSv1.3 and Weak CBC Ciphers in Firewall and Security Management

TLSv1.3 and Weak CBC Ciphers

Sanjay_S — Tue, 23 Aug 2022 11:29:35 GMT

Hi All,

We are planning to enable the inspection of TLSv1.3 on R81 gateways. I went through the below document to enable it but not really sure whether the interface IPs configured on firewalls will also be inspected with the TLSv1.3. Also may i know whether this will affect the TLSv1.2 traffic passing through the firewall once we enable this option?

HTTPS Inspection (checkpoint.com)

We are also planning to disable weak CBC ciphers but did not find any such documents related to disable. When it comes to Cisco ASA it can be done directly in ASDM but not finding any options in Checkpoint, could you please help me with any such documents which helps me with the configuration on removing the weak Ciphers?

Also will there be any impact other than not negotiating with the weak ciphers? Mainly when negotiating for the Remote Access VPN.

Regards,

Sanjay S

Re: TLSv1.3 and Weak CBC Ciphers

PhoneBoy — Tue, 23 Aug 2022 12:01:55 GMT

Different infrastructure needs to be enabled to inspect TLS 1.3.
It will also inspect TLS 1.2 and earlier.

For the cipher question: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk126613&partition=Advanced&product=Quantum

Re: TLSv1.3 and Weak CBC Ciphers

Sanjay_S — Tue, 23 Aug 2022 12:42:37 GMT

Thank you PhoneBoy this really helps.

Re: TLSv1.3 and Weak CBC Ciphers

Sanjay_S — Tue, 06 Sep 2022 13:27:49 GMT

Hi PhoneBoy,

Is there any list of approved Ciphers by Checkpoint to use and weak ciphers list which we can disable?

Regards,

Sanjay S

Re: TLSv1.3 and Weak CBC Ciphers

PhoneBoy — Tue, 06 Sep 2022 14:36:12 GMT

Do we have a specific document? No.
The ciphers we have enabled by default should provide the best mix of usability and security.
Additional ones can be disabled based on your precise requirements.