Resolving TLS1.0 and TLS1.1 Security Threats for Remote Access

[P_Williams]

I have been sent a report listing various public facing services on our firewalls and whether they are allowing TLS1.0 and TLS1.1.

For the URL that clients use to connect to use the Remote Access vpn it has come back as allowing 1.0 and 1.1

Risk Vector	Finding Identifier	Last Seen	Grade	Attributed To	Finding Severity
SSL Configurations	remoteaccess.mycompany.com:443	27/03/2025	BAD	My Company Inc.	severe

Asset Importance	Assets	Details
critical	remoteaccess.mycompany.com	Allows insecure protocol: TLSv1.0; Allows insecure protocol: TLSv1.1

Presumably the client, when it connects initially, wouldn't be using 1.0 or 1.1. But beyond that I don't know what I can do to get rid of the vulnerability. I am not sure if the vulnerability even is to do with the RemoteAccess service, it is just that it uses the same public IP as the firewalls.

What could I do on the firewall to remove this vulnerability?

The firewalls are VSX running r81

[G_W_Albrecht]

See sk178505: Which TLS version do Check Point products use?

and then

sk154532: Vulnerability scan detects that the Security Gateway supports TLS 1.0 or TLS 1.1 when one ...

[P_Williams]

That looks promising, many thanks. Looks like it will need a proper review and CAB before implementing but will feedback how I get on.

[G_W_Albrecht]

It is just an advanced Portal configuration option in SmartDashboard menue, see the screenshot @the_rock has posted.

[P_Williams]

Hi,

Just confirming that this worked, we changed the setting to 1.2 and the vulnerability scan has now succeeded. Thank you

[the_rock]

Hey @P_Williams 

I believe you can also correct this with settings I attached from global properties.

Andy

[G_W_Albrecht · Accepted solution]

Yes, found here: sk154532: Vulnerability scan detects that the Security Gateway supports TLS 1.0 or TLS 1.1 when one ...

[the_rock]

Sorry, my bad, it asked me to log in to view that sk when I tried yesterday, but I see it now.

Andy

[G_W_Albrecht]

You did post the shortcut 🙃