topic Legacy Client auth SSL/TLS version in Firewall and Security Management

Legacy Client auth SSL/TLS version

John_Fleming — Sat, 22 Aug 2020 06:56:03 GMT

I'm trying to track down how to get legacy client authentication to disable SSLv2/v3 TLS1.0 and TLS1.1. I found

sk102989 - Check Point response to the POODLE Bites vulnerability (CVE-2014-3566)

and

sk100584 - Cipher strength for Client Authentication feature is under 128-bit and there is no way to control which SSL version to use

both basically say to set ASSL_NO_SSLV2=1 and ASSL_NO_SSLV3=1 (how they say to set them is a little different but end result looks the same).

However sk100584 also says how to disable TLS1.0 (but not TLS 1.1 ?) but also says you can't disable all three.

I'm a little confused what is the proper way to disable the insecure protocols here. My goal would be to only support TLS1.2 for client auth. Yes, I know captive portal would be better but we're not in a place where we can move everything yet.

Re: Legacy Client auth SSL/TLS version

PhoneBoy — Sat, 22 Aug 2020 15:40:51 GMT

As you probably know, Client Auth is a legacy feature.
Not sure if fixing Client Auth falls under @Royi_Priov ’s team or not.
That said, understanding the precise use case for Client Auth may be useful so we can make Identity Awareness support it.

Re: Legacy Client auth SSL/TLS version

Royi_Priov — Mon, 24 Aug 2020 06:04:55 GMT

@Nachum_Moshe can you please assist?

Re: Legacy Client auth SSL/TLS version

Nachum_Moshe — Mon, 24 Aug 2020 11:32:26 GMT

topic Legacy Client auth SSL/TLS version in Firewall and Security Management

Legacy Client auth SSL/TLS version

Re: Legacy Client auth SSL/TLS version

Re: Legacy Client auth SSL/TLS version

Re: Legacy Client auth SSL/TLS version

Client authentication supports only TLS and SSLv3. SSLv2 is not supported.

We have 2 relevant flags within this legacy feature: TLS and SSLv3.

TLS is enabled by default. To disable it, need to configure ASSL_NO_TLS=1. There is no option to distinguish between TLS versions.

As for SSLv3,

from R80.40, SSLv3 is disabled by default. To enable it, need to configure ASSL_NO_SSLV3=0.

before R80.40, on Jumbos, SSLv3 is enabled by default. To disable it, need to configure ASSL_NO_SSLV3=1.

Nachum

GM, Web Security Framework.