topic Re: Check Point VPN encprytion and FIPS 140-2 in SASE and Remote Access

Check Point VPN encprytion and FIPS 140-2

Daniel_Kavan — Thu, 13 Aug 2020 13:18:39 GMT

Hi,

Is the Endpoint Security, SSLVPN (TLS 1.2) or IPSEC tunnel traffic (AES-256, SHA256, Group 2) considered FIPS 140-2 validated encryption? If its not called FIPS 140-2 validated encryption what is it called? Non-validated encryption/basic encryption/encryption? Our security auditors want to know.

side point: It would be nice to be able to print out crypto-maps like CISCO for VPN configs or something else that's graphical and sums up VPN encryption/access or both.

This is the official request:

Encryption configuration for remote access. If FIPS 140-2 validated encryption is being used please demonstrate the cryptographic module was configured in accordance with the CMVP security policy.

Re: Check Point VPN encprytion and FIPS 140-2

Ryan_St__Germai — Thu, 13 Aug 2020 03:03:43 GMT

Are the auditors asking if Checkpoint is using a validated cryptographic module that needs to be listed here?: https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules

If so....Then as long as you are running R77.30 https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/2995

Re: Check Point VPN encprytion and FIPS 140-2

PhoneBoy — Thu, 13 Aug 2020 04:23:29 GMT

There’s also the client side of this: https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/2788
I assume we are working on getting a more recent version of the modules certified but they aren’t substantially different from what’s in these releases.

Re: Check Point VPN encprytion and FIPS 140-2

Daniel_Kavan — Tue, 29 Sep 2020 15:32:53 GMT

FISMA auditors are here & they say

That CMVP cert says “When operated in FIPD mode” in the Caveat section. So there is a switch. Can you check it to find out its status?

Normally, there would be a way to initiate FIPS mode for FIPS capable products. If there is a way to initiate FIPS mode, is that being used?

-Show that the VPN is running in FIPS mode or using FIPS-validated cryptography for data in transit. I believe currently we only have a screenshot showing that TLS 1.2 and higher is being used.

-Show how a user’s VPN connection would be disconnected by an administrator.

Re: Check Point VPN encprytion and FIPS 140-2

Daniel_Kavan — Mon, 01 Feb 2021 19:47:16 GMT

RE:VPN only

RE: S2S, fat C2S and/or SSLVPN? Maybe, you have to run in the gw in FIPS mode as a pre-req to VPN, I'm not sure. After that, how do you set FIPS on for the TLS 1.2 connection to SSLVPN? I'm guessing there are 3 things involved 1. windows OS 2. browser 3. network extender

I have to assume that FIPS library is enabled by default in the browser when a user connects with TLS 1.2 to our sslvpn, but how can I show proof?

On the gateway, is there a way to show an auditor fips is on for VPN? I see here you can turn it ON in general for the gateway, with some serious limitations. https://community.checkpoint.com/t5/Security-Gateways/FIPS-mode-operation-and-some-manual-configurations/m-p/97289.

Re: Check Point VPN encprytion and FIPS 140-2

Daniel_Kavan — Thu, 15 Sep 2022 12:23:46 GMT

Another year, here we go agian...

1. Crypto module and CMVP utilized by the VPN.
2. Crypto modules and CMVPs that applications instances utilize to communicate inside the cloud.

Re: Check Point VPN encprytion and FIPS 140-2

Daniel_Kavan — Tue, 20 Sep 2022 11:18:08 GMT

Cryptographic Module Validation Program | CSRC (nist.gov)

It looks like #4264 is the latest, still we have FIPs mode disabled on our GW. I assume if FIPs is disabled none of the blades are using this.

Re: Check Point VPN encprytion and FIPS 140-2

Daniel_Kavan — Tue, 05 Mar 2024 21:58:13 GMT

Now, I'm being asked about FIPS 140-3-certified. I assume that will take a while, maybe R82. Does the current FIPS 140-2-certified include the SD-WAN blade? Or do the blades get grandfathered in?