topic Re: Connections to Checkpoint native services do not encrypt within the VPN for firewall management in Firewall and Security Management

Connections to Checkpoint native services do not encrypt within the VPN for firewall management

jarvis_dantsrib — Fri, 09 May 2025 05:06:41 GMT

Hello, I am facing a problem where connections on service port 18191 and Checkpoint native services are not encrypted within the VPN, as a consequence it is not possible to manage the firewall and install policy of the remote unit via LAN IP.

The interesting thing is that only Checkpoint service traffic is not encrypted, but ICMP, SSH, HTTPS and other non-native services are encrypted within the VPN.

It is possible to see that there is a match in implicit accept rules, but the traffic is encrypted.

Re: Connections to Checkpoint native services do not encrypt within the VPN for firewall management

emmap — Fri, 09 May 2025 05:20:40 GMT

This is by design, the CP service traffic is already encrypted and is required to be working to set up a VPN to a remote device over the internet as you need to install the policy to get the VPN going. As such we don't tunnel it by default. You can change this behaviour, but at your risk.

https://support.checkpoint.com/results/sk/sk104582

Re: Connections to Checkpoint native services do not encrypt within the VPN for firewall management

jarvis_dantsrib — Fri, 09 May 2025 15:45:15 GMT

Hello, This SK is not accessible to me

Re: Connections to Checkpoint native services do not encrypt within the VPN for firewall management

PhoneBoy — Fri, 09 May 2025 17:13:10 GMT

The solution (and its implications) are discussed in these two CheckMates threads:

Re: Connections to Checkpoint native services do not encrypt within the VPN for firewall management

akurtasanov — Mon, 09 Mar 2026 08:35:06 GMT

I don't know why but this SK doesn't work for R82 SMS and R81.20 GW configuration.
Right now, I've excluded next:

/* #define ENABLE_CPMI */

/* #define ENABLE_CPD */

/* #define ENABLE_FWD_LOG */

And after policy installation I see same clear text traffic via VPNT interface.

Re: Connections to Checkpoint native services do not encrypt within the VPN for firewall management

emmap — Mon, 09 Mar 2026 08:56:35 GMT

Please make sure you are editing the right instance of the file. https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Content/Topics-SECMG/Configuring_Implied_Rules_or_Kernel_Tables_for_Security_Gateways_implied_rules.def.htm

Re: Connections to Checkpoint native services do not encrypt within the VPN for firewall management

akurtasanov — Fri, 13 Mar 2026 08:02:29 GMT

Yes, I checked. I contacted TAC but so far no results. Restarting the SMS didn't help either.