topic Re: Checkpoint with Thousandeyes in General Topics

Checkpoint with Thousandeyes

ma_gorkhali — Mon, 31 Mar 2025 10:35:01 GMT

Anyone integrated thousandeyes with Checkpoint? Looks like there is some incompatibility between SNMP cipher?

Re: Checkpoint with Thousandeyes

the_rock — Mon, 31 Mar 2025 11:36:47 GMT

I found a post from last year where Phoneboy indicated he was not aware of any known issues. I checked Thousandeyes documentation, could not find anything specific either.

Do you have any link or statement about this?

Andy

Re: Checkpoint with Thousandeyes

ma_gorkhali — Mon, 31 Mar 2025 13:05:54 GMT

@the_rock these are the options that Thousandeyes support for SNMPV3 and I have tried all the options and while capturing packet from checkpoint I can see packets coming through and also moving from i > I .

Re: Checkpoint with Thousandeyes

the_rock — Mon, 31 Mar 2025 13:07:58 GMT

So none of them work? 😞

Re: Checkpoint with Thousandeyes

ma_gorkhali — Mon, 31 Mar 2025 13:17:50 GMT

Sadly noone of them worked.

I was wondering if I could find some expert here who has deployed thousandeyes with checkpoint.

Re: Checkpoint with Thousandeyes

the_rock — Mon, 31 Mar 2025 13:19:02 GMT

K, lets wait and see if someone might have an idea.

Re: Checkpoint with Thousandeyes

Bob_Zimmerman — Mon, 31 Mar 2025 15:55:58 GMT

As of R81.20, Check Point only supports usmHMAC192SHA256AuthProtocol and usmHMAC384SHA512AuthProtocol for authentication (RFC 7860), and DES (RFC 3414), AES-128 (RFC 3826), or AES-256 (non-standard) for privacy. It definitely works with Thousandeyes. I would go with usmHMAC384SHA512AuthProtocol and AES-128.

Re: Checkpoint with Thousandeyes

ma_gorkhali — Mon, 31 Mar 2025 23:46:26 GMT

There is no AES-128 option in Checkpoint and I am using privacy-protocol AES256 authentication-protocol SHA512

Re: Checkpoint with Thousandeyes

the_rock — Tue, 01 Apr 2025 00:19:03 GMT

I would verify with TAC on this.

Andy

Re: Checkpoint with Thousandeyes

Bob_Zimmerman — Tue, 01 Apr 2025 13:19:11 GMT

@ma_gorkhali wrote:

There is no AES-128 option in Checkpoint and I am using privacy-protocol AES256 authentication-protocol SHA512

There absolutely is an AES-128 option, they just leave off the key length (128 bits is the only RFC-compliant AES key length):

[Expert@MyManagement]# fwm ver This is Check Point Security Management Server R81.20 - Build 017 [Expert@MyManagement]# cpinfo -y fw1 This is Check Point CPinfo Build 914000250 for GAIA [FW1] HOTFIX_INEXT_NANO_EGG_AUTOUPDATE HOTFIX_R81_20_JUMBO_HF_MAIN Take: 92 HOTFIX_WEBCONSOLE_AUTOUPDATE HOTFIX_GOT_MGMT_AUTOUPDATE HOTFIX_NGM_DOCTOR_AUTOUPDATE HOTFIX_VCE_R81_20_AUTOUPDATE HOTFIX_GOT_TPCONF_MGMT_AUTOUPDATE HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE FW1 build number: This is Check Point Security Management Server R81.20 - Build 017 This is Check Point's software version R81.20 - Build 043 [Expert@MyManagement]# clish MyManagement> add snmp usm user NewUser security-level authPriv auth-pass-phrase vpn123 privacy-pass-phrase vpn123 privacy-protocol DES AES AES256 MyManagement> add snmp usm user NewUser security-level authPriv auth-pass-phrase vpn123 privacy-pass-phrase vpn123 privacy-protocol AES authentication-protocol SHA256 SHA512 MyManagement> add snmp usm user NewUser security-level authPriv auth-pass-phrase vpn123 privacy-pass-phrase vpn123 privacy-protocol AES authentication-protocol SHA