Vulnerability Mitigation for TLS 1.0 and Weak Ciphers

[LostBoY]

Hello,

I need  instructions to mitigate the following two vulnerabilities from our Gateways : 

1) Enable Support for TLS 1.1 and TLS 1.2 , and disable TLS  1.0

2) Removal of Weak Ciphers

We are using a VSX Cluster environment with R80.10

Also, what could be the after effects after removing these vulnerabilities on the existing production environment.

Please suggest.

Thanks

[PhoneBoy]

As there isn't one global "use TLSv1.2" and "disable weak ciphers" setting, we need some more context, namely on what ports these issues were found.
The main one the comes up (Gaia WEBUI) isn't relevant on VSX.

[LostBoY]

thanks for the reply.. vulnerability has been reported on port 443 (TLS 1.0 Protocol Detection) ...discovered on 2 VSX Gateways which are in cluster

[PhoneBoy]

What blades are active on this gateway?
Like I said, the main culprit (the Gaia WebUI) is not active on VSX.

[LostBoY]

AntiBot, Antivirus, IPS

[G_W_Albrecht]

Maybe also SSL Inspection ? Then see sk126613: Cipherconfiguration tool for R80.x Gateways.

[Parmod]

how to remediate TLS vulnerability on checkpoint firewall Virtual interface

and sk126613: Cipherconfiguration tool for R80.x Gateways.  is not clearing this requirement @

G_W_Albrecht

[sushilsharma]

1) Enable Support for TLS 1.1 and TLS 1.2 , and disable TLS  1.0

Note: I am a novice user, so please check in test setup before applying to production.

Solution: In Smart console menu->Global properties->Advanced->Configure...

Go to portal properties, there it will show option to set max and min ssl version attributes.

There you may change ssl min. version from TLS1.0 to TLS1.1.

[fklim]

awesome, thanks  for sharing

[Prime]

Follow -sk147272 , sk106031 to mitigate the above vulnerability.

 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...