topic Re: AES-GCM support - IPsec Phase1 in General Topics

AES-GCM support - IPsec Phase1

Vilius — Thu, 23 Mar 2023 09:09:57 GMT

Hello,

Checking R80.40 or R81 VPN administration guide i only see AES-128/256 for Site-to-site IPsec Phase 1 configuration. I believe that implies CBC. How about support for AES-256GCM in Phase1? Is it possible to support it by upgrading to some specific version or by enabling support somewhere under the hood?

I am receiving requests to negotiate GCM for both phases and actually one of the S2S remote party says they are stopping CBC support for IPSec.

Thanks

Re: AES-GCM support - IPsec Phase1

_Val_ — Thu, 23 Mar 2023 09:29:18 GMT

At this point, we only support AES-GCM ciphers with Phase 2. If you need then with Phase 1, please open an RFE.

Re: AES-GCM support - IPsec Phase1

Brad_Muller — Fri, 04 Aug 2023 19:54:52 GMT

We are seeing more and more vendors requiring AES-GCM in Phase 1. Does Check Point have any documentation that explains why they chose not to support it? It would be great to have some ammunition to fire back.

Re: AES-GCM support - IPsec Phase1

Vilius — Wed, 16 Aug 2023 08:48:59 GMT

There are references to CP implementation using and recommending NSA Suite-B cryptography. It is not helpful much, because Suite-B is now depreciated in favor of Commercial National Security Algorithm Suite (CNSA). Quantum Computing Recommended Site-to-Site VPN configuration (checkpoint.com)

I did submit RFE through CP representative. Last update is that we can expect full AES-GCM support with next major release in 2024. Given usual time frame for version to be recommended and corporate upgrade cycles, this will be an issue for foreseeable future.

Re: AES-GCM support - IPsec Phase1

idants — Mon, 21 Aug 2023 19:04:09 GMT

We are considering to add it, I will update soon.

Thanks,

Idan Tsarfati

IPsec VPN R&D group manager

Re: AES-GCM support - IPsec Phase1

pulidan — Tue, 19 Dec 2023 21:42:30 GMT

Idan, We have a case open for this now in December of 2023.. please let us know when AES-GCM will be part of the release. I am at R81.20 and have a Site-to-Site tunnel that will be going down if we do not have GCM support for Phase 1. We'll simply have to buy a competitive product, and I've been loyal to Check Point for almost 26 years. Please advise.

Thanks,

Dan

Re: AES-GCM support - IPsec Phase1

Alex- — Wed, 17 Jan 2024 06:21:11 GMT

We are seeing more requests to move VPN's to IKEv2 and AEAD suites only as well.Let's hope this functionality is underway.

Re: AES-GCM support - IPsec Phase1

CaseyB — Thu, 18 Jan 2024 18:10:44 GMT

I have been informed that GCM ciphers will be supported for Phase 1 in R82.

Re: AES-GCM support - IPsec Phase1

idants — Sun, 21 Jan 2024 14:16:37 GMT

Correct, AES-GCM in phase will be supported in R82.