topic Re: R80.30 - ClusterXL CCP Encryption! in General Topics

R80.30 - ClusterXL CCP Encryption!

HeikoAnkenbrand — Wed, 20 Mar 2019 20:08:26 GMT

Under R80.30 it is possible to encrypt CCP traffic. This is very useful to protect the cluster from manipulated CCP packets. Therefore new commands have been implemented on the CLI for this purpose. The following description shows you how to enable CCP encryption. All settings you make on the CLI are permanently stored in the following file “/etc/fw.boot/ha_boot.conf”. This means that all settings are preserved after the reboot. You have to set the settings on both gateways and they will take effect on the fly. The CCP encryption is disabled by default and must be enabled via CLI on both gateways.

The CCP Encryption:

Supports SHA-256 hash.
Key replacement is done on every policy installation
Encryption & decryption is done by CPU using AES-GCM to achieve minimal effect on performance.

Example commands:

# cphaprob ccp_encrypt

clish> show cluster members ccpenc

With the following command the encryption can be permanently enabled on the fly:

# cphaconf ccp_encrypt on

In this way the encryption can be disabled on the fly

# cphaconf ccp_encrypt off

With this command you can test if the CCP encryption works. Here you should not see any cluster status information on the sync interface (blue). All packages should be visible under unknown when CCP encryption is enabled.

# tcpdump -nepi eth1 -x port -s 0 8116 2>/dev/null | ccp_analyzer -g –c

Unfortunately it is no longer possible to analyze the CCP packets via "ccp_analyzer " when encryption is enabled.

The CLISH commands:

Toggle encryption mode: “set cluster member ccpenc <on/off>”
Show encryption mode: “show cluster members ccpenc”

The commands under expert mode:

Toggle encryption mode: "cphaconf ccp_encrypt <on/off>"
Show encryption mode: "cphaprob ccp_encrypt"
Display encryption key: "cphaprob ccp_encrypt_key

More interesting articles: cp.ankenbrand24.de

Re: R80.30 - ClusterXL CCP Encryption!

Sabine_Freimann — Sun, 17 Feb 2019 19:11:46 GMT

Is this already available with R80.20?

Re: R80.30 - ClusterXL CCP Encryption!

HeikoAnkenbrand — Sun, 17 Feb 2019 20:46:04 GMT

Hi Sabine,

Only R80.30+

Re: R80.30 - ClusterXL CCP Encryption!

Armin__Alic — Mon, 18 Feb 2019 04:01:16 GMT

nice

Re: R80.30 - ClusterXL CCP Encryption!

Dmitry_Krupnik — Mon, 18 Feb 2019 14:45:05 GMT

Hi Heiko,

Thank you, that share this information with CheckMates. Did you mean "R80.30 - ClusterXL CCP Encryption!", right?

Regards,

Dmitry.

Re: R80.30 - ClusterXL CCP Encryption!

HeikoAnkenbrand — Mon, 18 Feb 2019 22:41:20 GMT

Hi Dmitry,

Thanks, I made a mistake. That must be named ClusterXL:-)

Regards

Heiko

Re: R80.30 - ClusterXL CCP Encryption!

Aviel_Ruijiling — Wed, 20 Feb 2019 10:36:53 GMT

Is it possible to use certificates to protect ccp sessions.

Re: R80.30 - ClusterXL CCP Encryption!

HeikoAnkenbrand — Wed, 20 Feb 2019 15:42:39 GMT

I don't know that.

Re: R80.30 - ClusterXL CCP Encryption!

Dmitry_Krupnik — Wed, 20 Feb 2019 20:20:13 GMT

Hi Heiko,

I would to provide more information about the CCP encryption, could you update your article according to it.

The CCP Encryption:

Supports SHA-256 encryption.
Key replacement is done on every policy installation
Encryption & decryption is done by CPU using AES-GCM to achieve minimal effect on performance.

You don't need to set key manually, it will be generated automatically and we recommend to use only this mode, at least because every policy installation will be generated new key (this option doesn't work if a key was set manually). The key can be set manually only as option for troubleshooting.

The CLISH commands:

Toggle encryption mode: “set cluster member ccpenc <on/off>”
Show encryption mode: “show cluster members ccpenc”

The commands under expert mode:

Toggle encryption mode: "cphaconf ccp_encrypt <on/off>"
Show encryption mode: "cphaprob ccp_encrypt"
Display encryption key: "cphaprob ccp_encrypt_key"

Regards,

Dmitry.

Re: R80.30 - ClusterXL CCP Encryption!

Dmitry_Krupnik — Wed, 20 Feb 2019 20:28:17 GMT

Hi Aviel,

No, it isn't possible. In my opinion, we don't have a reason to use certificates here.

Regards,

Dmitry.

Re: R80.30 - ClusterXL CCP Encryption!

Tim_Tielens — Fri, 22 Feb 2019 12:06:29 GMT

What kind of performance impact are we talking about when enabling CCP encryption ?

It says: "minimal effect on performance"

But are there numbers available ?

Re: R80.30 - ClusterXL CCP Encryption!

PhoneBoy — Fri, 22 Feb 2019 18:37:55 GMT

The encryption/decryption is most likely using AES-NI instructions built into recent Intel processors.

On systems that don't have AES-NI instructions, I imagine the performance impact will be a bit more noticeable.

As for exact numbers, I don't think we can comment until after GA.

Re: R80.30 - ClusterXL CCP Encryption!

HeikoAnkenbrand — Sun, 24 Feb 2019 15:08:12 GMT

Intel‘s AES New Instructions AES-NI is a encryption instruction set that improves on the Advanced Encryption Standard (AES) algorithm and accelerates the encryption of data in many processor familys.

Comprised of seven new instructions, AES-NI gives your environment faster, more affordable data protection and greater security.

You found more informations about AES NI here:

https://community.checkpoint.com/docs/DOC-3278-r80x-performance-tuning-tip-aes-ni

Re: R80.30 - ClusterXL CCP Encryption!

Slavisa_Stojkov — Fri, 12 Apr 2019 12:49:31 GMT

Can I change the encrytion algorithm.

Re: R80.30 - ClusterXL CCP Encryption!

Pasqual_Woodcoc — Sat, 10 Aug 2019 07:55:51 GMT

Very nice feature. I have all cluster encrypted:-)

Re: R80.30 - ClusterXL CCP Encryption!

Paul_Erez — Thu, 05 Sep 2019 19:00:01 GMT

We use now the encryption. It works fine.

Thanks

Re: R80.30 - ClusterXL CCP Encryption!

cir007 — Fri, 06 Sep 2019 12:15:41 GMT

Unfortunately, it is no longer possible to analyze the CCP packets via "ccp_analyzer " when encryption is enabled.

Is there any other way to analyze CCP packets, or do I need to simply disable encryption when debugging clusterxl?

BR Jernej

Re: R80.30 - ClusterXL CCP Encryption!

Timothy_Hall — Fri, 27 Sep 2019 12:09:31 GMT

To further clarify, CCP encryption is enabled by default on R80.30 Gaia kernel version 3.10 only. CCP encryption is disabled by default on R80.30 Gaia kernel version 2.6.18. See sk162358: R80.30 cluster, with CCP Encryption enabled, managed by an R80.10 Security Management comes up in Active/Active state Just noticed this difference in my lab and could not figure out what was going on until I found that SK.

Also tagging @PhoneBoy with this follow-up question: If CCP encryption is enabled it impacts both CCP traffic emanating out all clustered interfaces presenting a Cluster IP, and the CCP traffic on the sync interface, correct? Is there any way to disable CCP encryption just for the state sync traffic (FWHAP_SYNC) yet leave it enabled for all the clustered interfaces presenting a Cluster IP? My guess is no, but if one has a crossover cable connecting the sync ports in a 2-member cluster, it would be nice to save the overhead involved encrypting/decrypting that heavy sync traffic if the sync network is known to be secure. Securing CCP on the cluster interfaces is still very important of course since they are accessible to the surrounding networks.

Yes I suppose someone could vampire into the sync cable and mess with the cluster if the sync network CCP traffic is not encrypted, but if the attacker already has physical access to your cluster and the sync cable you've got much bigger problems afoot...