topic Re: Weak Ciphers Removal in SASE and Remote Access

Weak Ciphers Removal

NeilDavey — Thu, 18 Apr 2019 10:02:43 GMT

On our MAB SSL VPN, I have restricted this to only use TLS1.2 and now I want to remove the weak cipher suites as shown.

I can see 2 possible ways of removing these:

Is there a better one of the 2 methods to use?

I was thinking the 2nd link would be better as it gives a full list of the individual ciphers that you can either allow or block.

Any suggestions welcome.

Thanks

G_W_Albrecht — Thu, 18 Apr 2019 11:14:14 GMT

I would use sk126613 for R80.xx version.

Mikel_Aanstoot — Thu, 18 Apr 2019 11:40:23 GMT

This is what we did:

Global Properties > Smartboard Customization > Configure > Portal Properties: changed snx_ssl_min_ver to TLS1.1 and max to TLS1.2

followed: sk120774 (your first link but this was when the gateways where R77.30)

and also on the gateways:

ckp_regedit -a SOFTWARE\\CheckPoint\\FW1 CPTLS_ACCEPT_ECDHE 1

ckp_regedit -a SOFTWARE\\CheckPoint\\FW1 CPTLS_PROPOSE_ECDHE 1

ckp_regedit -a SOFTWARE\\CheckPoint\\FW1 DISABLE_3DES 1