AES-GCM support - IPsec Phase1

[Vilius]

Hello,

Checking R80.40 or R81 VPN administration guide i only see AES-128/256 for Site-to-site IPsec Phase 1 configuration. I believe that implies CBC. How about support for AES-256GCM in Phase1? Is it possible to support it by upgrading to some specific version or by enabling support somewhere under the hood?

I am receiving requests to negotiate GCM for both phases and actually one of the S2S remote party says they are stopping CBC support for IPSec. 

Thanks

[_Val_ · Accepted solution]

At this point, we only support AES-GCM ciphers with Phase 2. If you need then with Phase 1, please open an RFE.

[Brad_Muller]

We are seeing more and more vendors requiring AES-GCM in Phase 1. Does Check Point have any documentation that explains why they chose not to support it? It would be great to have some ammunition to fire back.

[Vilius]

There are references to CP implementation using and recommending NSA Suite-B cryptography. It is not helpful much, because Suite-B is now depreciated in favor of Commercial National Security Algorithm Suite (CNSA).  Quantum Computing Recommended Site-to-Site VPN configuration (checkpoint.com)

I did submit RFE through CP representative. Last update is that we can expect full AES-GCM support with next major release in 2024. Given usual time frame for version to be recommended and corporate upgrade cycles, this will be an issue for foreseeable future. 

[idants]

We are considering to add it, I will update soon.

Thanks,

Idan Tsarfati

IPsec VPN  R&D group manager