cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

Activate PFS in a VPN community via API

Jump to solution

Hello Checkpoint,

in the after Snowden aera,  we have learnt that perfect forward secrecy is one of the most important cryptographic features.

From the API documentation it is not clear how to activate PFS and how to select the PFS group when creating a VPN community or modifying an existing one.

Please Clarify: How can I activate PFS and select the PFS DH group via the API?

Thanks

Christian Riede

0 Kudos
2 Solutions

Accepted Solutions
Maik
Silver

Re: Activate PFS in a VPN community via API

Jump to solution

Hey Christian,

 

The standard managment API (still) does not support the configuration that you need.

But @Kim_Moberg did a nice writeup regarding his solution via the generic objects API - see here.

 

Regards

0 Kudos

Re: Activate PFS in a VPN community via API

Jump to solution

 

Summary:

find uid of community

mgmt_cli show vpn-community-star name "communityname"

find uid of dh group:

mgmt_cli show generic-objects class-name com.checkpoint.objects.classes.dummy."CpmiIkeDiffieHellmanParametersObject"

mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1EncAlg AES_MINUS_256
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1HashAlg SHA256
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1DhGrp 86ee63a3-cb9a-478e-add4-857aff8a7ab3
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1RekeyTime 1440
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EncAlg AES_MINUS_256
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2HashAlg SHA256
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2RekeyTime 3600
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2UsePfs true
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2PfsDhGrp 86ee63a3-cb9a-478e-add4-857aff8a7ab3
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EnableSupernetFromR8020 FALSE

 

0 Kudos
3 Replies
Maik
Silver

Re: Activate PFS in a VPN community via API

Jump to solution

Hey Christian,

 

The standard managment API (still) does not support the configuration that you need.

But @Kim_Moberg did a nice writeup regarding his solution via the generic objects API - see here.

 

Regards

0 Kudos

Re: Activate PFS in a VPN community via API

Jump to solution

Summary:

Get Community uid with:

mgmt_cli show vpn-community-star name "communityname"

Get DH group UIDs with:

mgmt_cli show generic-objects class-name com.checkpoint.objects.classes.dummy."CpmiIkeDiffieHellmanParametersObject"

 

Then:

mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1EncAlg "AES_MINUS_256"
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1HashAlg "SHA256"
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1DhGrp "86ee63a3-cb9a-478e-add4-857aff8a7ab3"
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1RekeyTime "1440"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EncAlg "AES_MINUS_256"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2HashAlg "SHA256"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2RekeyTime "3600"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2UsePfs "true"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2PfsDhGrp "86ee63a3-cb9a-478e-add4-857aff8a7ab3"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EnableSupernetFromR8020 "FALSE"

0 Kudos

Re: Activate PFS in a VPN community via API

Jump to solution

 

Summary:

find uid of community

mgmt_cli show vpn-community-star name "communityname"

find uid of dh group:

mgmt_cli show generic-objects class-name com.checkpoint.objects.classes.dummy."CpmiIkeDiffieHellmanParametersObject"

mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1EncAlg AES_MINUS_256
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1HashAlg SHA256
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1DhGrp 86ee63a3-cb9a-478e-add4-857aff8a7ab3
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1RekeyTime 1440
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EncAlg AES_MINUS_256
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2HashAlg SHA256
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2RekeyTime 3600
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2UsePfs true
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2PfsDhGrp 86ee63a3-cb9a-478e-add4-857aff8a7ab3
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EnableSupernetFromR8020 FALSE

 

0 Kudos