topic Re: Activate PFS in a VPN community via API in API / CLI Discussion

Activate PFS in a VPN community via API

Christian_Riede — Wed, 27 Mar 2019 15:09:13 GMT

Hello Checkpoint,

in the after Snowden aera, we have learnt that perfect forward secrecy is one of the most important cryptographic features.

From the API documentation it is not clear how to activate PFS and how to select the PFS group when creating a VPN community or modifying an existing one.

Please Clarify: How can I activate PFS and select the PFS DH group via the API?

Thanks

Christian Riede

Re: Activate PFS in a VPN community via API

Maik — Wed, 27 Mar 2019 15:24:54 GMT

Hey Christian,

The standard managment API (still) does not support the configuration that you need.

But @Kim_Moberg did a nice writeup regarding his solution via the generic objects API - see here.

Regards

Re: Activate PFS in a VPN community via API

Christian_Riede — Thu, 28 Mar 2019 10:51:29 GMT

Summary:

Get Community uid with:

mgmt_cli show vpn-community-star name "communityname"

Get DH group UIDs with:

mgmt_cli show generic-objects class-name com.checkpoint.objects.classes.dummy."CpmiIkeDiffieHellmanParametersObject"

Then:

mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1EncAlg "AES_MINUS_256"
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1HashAlg "SHA256"
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1DhGrp "86ee63a3-cb9a-478e-add4-857aff8a7ab3"
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1RekeyTime "1440"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EncAlg "AES_MINUS_256"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2HashAlg "SHA256"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2RekeyTime "3600"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2UsePfs "true"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2PfsDhGrp "86ee63a3-cb9a-478e-add4-857aff8a7ab3"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EnableSupernetFromR8020 "FALSE"

Re: Activate PFS in a VPN community via API

Christian_Riede — Thu, 28 Mar 2019 10:56:37 GMT

Summary:

find uid of community

mgmt_cli show vpn-community-star name "communityname"

find uid of dh group:

mgmt_cli show generic-objects class-name com.checkpoint.objects.classes.dummy."CpmiIkeDiffieHellmanParametersObject"

mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1EncAlg AES_MINUS_256
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1HashAlg SHA256
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1DhGrp 86ee63a3-cb9a-478e-add4-857aff8a7ab3
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1RekeyTime 1440
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EncAlg AES_MINUS_256
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2HashAlg SHA256
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2RekeyTime 3600
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2UsePfs true
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2PfsDhGrp 86ee63a3-cb9a-478e-add4-857aff8a7ab3
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EnableSupernetFromR8020 FALSE