topic Re: PCI Scans Failing and Disablement of DES and DH Group 1 in General Topics

PCI Scans Failing and Disablement of DES and DH Group 1

D_Riddleberger — Thu, 23 Apr 2026 19:16:22 GMT

I have a site where PCI Scans are failing for DES and DH Group 1 vulnerabilities.

I'm pretty sure that we can disable DES exposure in Cluster>IPSEC VPN>Traditional Mode>General Properties (see pic) while following sk82900

https://support.checkpoint.com/results/sk/sk82900.

But in same pane/pic for Advanced Properties, it lists all the supported DH Groups and DH-1 Group is not selected.

So I need a document or sk for how/why DH Group-1 is being detected and how to disable it

Re: PCI Scans Failing and Disablement of DES and DH Group 1

Lesley — Thu, 23 Apr 2026 20:10:44 GMT

Maybe worth to check also here

Re: PCI Scans Failing and Disablement of DES and DH Group 1

Lesley — Thu, 23 Apr 2026 20:23:05 GMT

Are the results maybe from a GAIA embedded unit? then check out

https://support.checkpoint.com/results/sk/sk184658

Re: PCI Scans Failing and Disablement of DES and DH Group 1

D_Riddleberger — Thu, 23 Apr 2026 21:02:35 GMT

Hi Lesley,

No, these are not embedded Gaia SMB Appliances.

Re: PCI Scans Failing and Disablement of DES and DH Group 1

Chris_Atkinson — Fri, 24 Apr 2026 01:16:54 GMT

You may also wish to review sk113114 more broadly

Re: PCI Scans Failing and Disablement of DES and DH Group 1

D_Riddleberger — Fri, 24 Apr 2026 17:47:46 GMT

Hi Chris,

Yes, that sk does provide some additional insight. Thank You.

I have confirmed that DES as well DH Group-1 is not used in any VPN Communities. As I did not think that it was. The problem is that the gateways are 'responding to' some level of acknowledgement/response from the scan that features/functionality for DES and DH Group 1 are enabled. I also confirmed from the scan report that it is IPSEC that is being flagged. So, I think we are in the clear for DES and DH Group 1 when it comes to SSH and Remote Access features/functionality whereas those can be turned off in Global Properties>Remote Access>VPN Auth and Encryption <edit algorithms>. I'm still digging....

Re: PCI Scans Failing and Disablement of DES and DH Group 1

the_rock — Fri, 24 Apr 2026 18:54:35 GMT

Hey Dan,

Seems like you have it all configured properly. Might be worth TAC case to confirm, for sure. I did check in smart console and all the settings you mentioned are 100% right.