Enabling TLS 1.3 for All Gateway Interfaces

[bhill3]

We are trying to ensure that TLS 1.3 is enabled on our Checkpoint Gateways and have successfully configured the primary interface of the Gateways to have TLS 1.3 enabled (as well as disable TLS 1.0 & TLS 1.1) by using the following clish commands:

show ssl tls enabled
set ssl tls TLSv1.0 off  # repeat as needed with other TLS versions
set ssl tls TLSv1.3 on
save config

This seems to have only applied to the primary interface of the Gateway. Is there a way that we can also ensure that TLS 1.3 is enabled for the secondary interface of the Gateway? Specifically we're looking to enable TLS 1.3 for port 443.

Thanks!

[Lesley]

https://support.checkpoint.com/results/sk/sk178505

[the_rock]

From expert mode -> cipher_util, option 2, then 2 again, follow the prompts.

Best,

Andy

[Daniel_Kavan]

Per sk178505, it doesn't mention TLS 1.3 for R82.10    Also, it looks like TLS 1.2 is the max (not TLSv1.3) for remote access (mobile).  see Remote Access VPN - SNX in Network Mode / Slim Client section in sk178505.  Any one have an ETA or know if it's being looked at for Mobile Access?  Qualys scans give us an A- now.  😞

cipher_util just shows and option for TLS 1.2, even after turning 1.3 on. set ssl tls TLSv1.3 on save config