topic Re: R80.10 - Remote Access VPN - Endpoint Security Diffie-Hellman Support in SASE and Remote Access

R80.10 - Remote Access VPN - Endpoint Security Diffie-Hellman Support

Jonathan_Griffi — Wed, 19 Jun 2019 12:41:05 GMT

Info:

Security Manager / Gateway Environment R80.10

Endpoint Security VPN Client: E80.97

Hi,

I won't pretend to know the cryptographic intricacies of all the differences between the numerous Diffie-Hellman groups; my question / concern is based on best practice while providing a balance between security and usability.

I've spent the last few hours trying to find content relating to why I can't use Diffie-Hellman Group 19/20 with my Remote Access VPN clients...using Endpoint Security E80.9x.

Within global properties on my SMS I can set some pretty respectable Encryption / Integrity algorithms. However, the "best" offering regarding Diffie-Hellman Groups is 14 (2048bits). I would like to know why I am unable to use Diffie-Hellman Groups 19/20 as this is really the minimum standard for IPSec as far as I can tell...happy to be corrected if this understanding is wrong?

I'm beginning to suspect this is a client limitation. I have checked the database with the guiDB tool and can see groups 19 and 20 are defined.

Some clarification and /or direction to the relevant resource would be much appreciated.

Thanks,

Jon

Re: R80.10 - Remote Access VPN - Endpoint Security Diffie-Hellman Support

PhoneBoy — Sun, 23 Jun 2019 21:39:50 GMT

You're correct that our VPN clients currently do not support DH Group 19/20.
You can see a reference to it here: http://downloads.checkpoint.com/dc/download.htm?ID=60345

Re: R80.10 - Remote Access VPN - Endpoint Security Diffie-Hellman Support

Jonathan_Griffi — Tue, 25 Jun 2019 14:03:41 GMT

@PhoneBoy thanks for letting me know...out of curiosity, do you know if this is something which will be added in future versions of the Endpoint Security Clients?

Cheers,

Jon

Re: R80.10 - Remote Access VPN - Endpoint Security Diffie-Hellman Support

PhoneBoy — Tue, 25 Jun 2019 18:51:45 GMT

Not aware of specific plans in this area.
If anyone knows, @Royi_Priov does.
You may also want to check in with your local Check Point office regarding this requirement.

Re: R80.10 - Remote Access VPN - Endpoint Security Diffie-Hellman Support

Royi_Priov — Wed, 26 Jun 2019 08:32:56 GMT

Hi @Jonathan_Griffi

Adding this support exists on our long term road map for the Endpoint VPN clients.

As @PhoneBoy wrote, contacting your local office to open an RFE can speed this up and prioritize it.

Thanks,

Royi.

Re: R80.10 - Remote Access VPN - Endpoint Security Diffie-Hellman Support

Jonathan_Griffi — Wed, 26 Jun 2019 10:08:48 GMT

@Royi_Priov thanks for confirming. Much appreciated.

Cheers,

Jon