topic Re: Forcing AES encryption Algorithm for SNX user in SASE and Remote Access

Forcing AES encryption Algorithm for SNX user

JaeYoung_An — Thu, 08 Jun 2023 08:49:51 GMT

Hi, Expert.

I would like to force AES for SNX user?

I’ve tried many ways, but user is keep using 3DES only. Can we force AES?

I’ve also followed https://support.checkpoint.com/results/sk/sk113114 to disable 3DES, but always 3DES is used.

This is same even in latest version.

Can anyone Advise how to use AES or confirm we can’t use AES?

Re: Forcing AES encryption Algorithm for SNX user

PhoneBoy — Thu, 08 Jun 2023 22:17:50 GMT

What precisely are the clients in this case?
If they're Linux, I suspect you're out of luck similar to: https://support.checkpoint.com/results/sk/sk180837
Windows and macOS SNX support AES on currently supported versions.

Re: Forcing AES encryption Algorithm for SNX user

JaeYoung_An — Fri, 09 Jun 2023 04:21:04 GMT

It's Windows 10 client with chrome browser

gateway version is R81.20

please refer to below pic

Re: Forcing AES encryption Algorithm for SNX user

PhoneBoy — Fri, 09 Jun 2023 16:03:30 GMT

You may want to make 100% certain 3DES is disabled globally per: https://support.checkpoint.com/results/sk/sk113114
Otherwise, I suggest a TAC case to assist: https://help.checkpoint.com

Re: Forcing AES encryption Algorithm for SNX user

Massimo_Manzato — Tue, 17 Dec 2024 11:49:16 GMT

sk116156 https://support.checkpoint.com/results/sk/sk116156 tell AES is supported by MacOS SNX client starting from R80.10

this obviously suggest that the SNX Server side support this encryption method as showed here:

Why this is not working ?

if I use SNX client or CAPSULE from windows the connections is always in 3DES.

there is a Check Point Employee that can explain how to solve using GuiDBEDIT?

thanks

Massimo

Re: Forcing AES encryption Algorithm for SNX user

PhoneBoy — Tue, 17 Dec 2024 14:23:17 GMT

Don't know that (gui)dbedit is the solution here.
I know this SK only mentions SMB appliances, but I see the referenced kernel variable on regular gateways (at least in R82): https://support.checkpoint.com/results/sk/sk112314
It's worth a shot.