Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Christian_Riede
Collaborator
Jump to solution

Activate PFS in a VPN community via API

Hello Checkpoint,

in the after Snowden aera,  we have learnt that perfect forward secrecy is one of the most important cryptographic features.

From the API documentation it is not clear how to activate PFS and how to select the PFS group when creating a VPN community or modifying an existing one.

Please Clarify: How can I activate PFS and select the PFS DH group via the API?

Thanks

Christian Riede

0 Kudos
2 Solutions

Accepted Solutions
Maik
Advisor

Hey Christian,

 

The standard managment API (still) does not support the configuration that you need.

But @Kim_Moberg did a nice writeup regarding his solution via the generic objects API - see here.

 

Regards

View solution in original post

0 Kudos
Christian_Riede
Collaborator

 

Summary:

find uid of community

mgmt_cli show vpn-community-star name "communityname"

find uid of dh group:

mgmt_cli show generic-objects class-name com.checkpoint.objects.classes.dummy."CpmiIkeDiffieHellmanParametersObject"

mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1EncAlg AES_MINUS_256
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1HashAlg SHA256
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1DhGrp 86ee63a3-cb9a-478e-add4-857aff8a7ab3
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1RekeyTime 1440
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EncAlg AES_MINUS_256
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2HashAlg SHA256
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2RekeyTime 3600
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2UsePfs true
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2PfsDhGrp 86ee63a3-cb9a-478e-add4-857aff8a7ab3
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EnableSupernetFromR8020 FALSE

 

View solution in original post

0 Kudos
3 Replies
Maik
Advisor

Hey Christian,

 

The standard managment API (still) does not support the configuration that you need.

But @Kim_Moberg did a nice writeup regarding his solution via the generic objects API - see here.

 

Regards

0 Kudos
Christian_Riede
Collaborator

Summary:

Get Community uid with:

mgmt_cli show vpn-community-star name "communityname"

Get DH group UIDs with:

mgmt_cli show generic-objects class-name com.checkpoint.objects.classes.dummy."CpmiIkeDiffieHellmanParametersObject"

 

Then:

mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1EncAlg "AES_MINUS_256"
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1HashAlg "SHA256"
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1DhGrp "86ee63a3-cb9a-478e-add4-857aff8a7ab3"
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1RekeyTime "1440"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EncAlg "AES_MINUS_256"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2HashAlg "SHA256"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2RekeyTime "3600"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2UsePfs "true"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2PfsDhGrp "86ee63a3-cb9a-478e-add4-857aff8a7ab3"
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EnableSupernetFromR8020 "FALSE"

0 Kudos
Christian_Riede
Collaborator

 

Summary:

find uid of community

mgmt_cli show vpn-community-star name "communityname"

find uid of dh group:

mgmt_cli show generic-objects class-name com.checkpoint.objects.classes.dummy."CpmiIkeDiffieHellmanParametersObject"

mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1EncAlg AES_MINUS_256
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1HashAlg SHA256
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1DhGrp 86ee63a3-cb9a-478e-add4-857aff8a7ab3
mgmt_cli set generic-object uid "uid-of-community" ikeP1.ikeP1RekeyTime 1440
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EncAlg AES_MINUS_256
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2HashAlg SHA256
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2RekeyTime 3600
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2UsePfs true
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2PfsDhGrp 86ee63a3-cb9a-478e-add4-857aff8a7ab3
mgmt_cli set generic-object uid "uid-of-community" ikeP2.ikeP2EnableSupernetFromR8020 FALSE

 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events