R80.30 - ClusterXL CCP Encryption!

[HeikoAnkenbrand]

Under R80.30 it is possible to encrypt CCP traffic.  This is very useful to protect the cluster from manipulated CCP packets.  Therefore new commands have been implemented on the CLI for this purpose. The following description shows you how to enable CCP encryption. All settings you make on the CLI are permanently stored in the following file “/etc/fw.boot/ha_boot.conf”.  This means that all settings are preserved after the reboot. You have to set the settings on both gateways and they will take effect on the fly. The CCP encryption is disabled by default and must be enabled via CLI on both gateways.

The CCP Encryption:

• Supports SHA-256 hash.
• Key replacement is done on every policy installation
• Encryption & decryption is done by CPU using AES-GCM to achieve minimal effect on performance.

Example commands:

# cphaprob ccp_encrypt         

clish> show cluster members ccpenc

With the following command the encryption can be permanently enabled on the fly:

# cphaconf ccp_encrypt on

In this way the encryption can be disabled on the fly

# cphaconf ccp_encrypt off

With this command you can test if the CCP encryption works. Here you should not see any cluster status information on the sync interface (blue). All packages should be visible under unknown when CCP encryption is enabled.

# tcpdump -nepi eth1 -x port -s 0 8116 2>/dev/null | ccp_analyzer -g –c

Unfortunately it is no longer possible to analyze the CCP packets via "ccp_analyzer " when encryption is enabled.

The CLISH commands:

• Toggle encryption mode: “set cluster member ccpenc <on/off>”
• Show encryption mode: “show cluster members ccpenc”

The commands under expert mode:

• Toggle encryption mode: "cphaconf ccp_encrypt <on/off>"
• Show encryption mode: "cphaprob ccp_encrypt"
• Display encryption key: "cphaprob ccp_encrypt_key

More interesting articles: cp.ankenbrand24.de

[Sabine_Freimann]

Is this already available with R80.20?

[HeikoAnkenbrand]

Hi Sabine,

Only R80.30+

[Timothy_Hall]

To further clarify, CCP encryption is enabled by default on R80.30 Gaia kernel version 3.10 only.  CCP encryption is disabled by default on R80.30 Gaia kernel version 2.6.18.  See sk162358: R80.30 cluster, with CCP Encryption enabled, managed by an R80.10 Security Management come...  Just noticed this difference in my lab and could not figure out what was going on until I found that SK.

Also tagging @PhoneBoy with this follow-up question: If CCP encryption is enabled it impacts both CCP traffic emanating out all clustered interfaces presenting a Cluster IP, and the CCP traffic on the sync interface, correct?  Is there any way to disable CCP encryption just for the state sync traffic (FWHAP_SYNC) yet leave it enabled for all the clustered interfaces presenting a Cluster IP?  My guess is no, but if one has a crossover cable connecting the sync ports in a 2-member cluster, it would be nice to save the overhead involved encrypting/decrypting that heavy sync traffic if the sync network is known to be secure.  Securing CCP on the cluster interfaces is still very important of course since they are accessible to the surrounding networks.

Yes I suppose someone could vampire into the sync cable and mess with the cluster if the sync network CCP traffic is not encrypted, but if the attacker already has physical access to your cluster and the sync cable you've got much bigger problems afoot...

[Armin__Alic]

nice

[Dmitry_Krupnik]

Hi Heiko,

Thank you, that share this information with CheckMates. Did you mean "R80.30 - ClusterXL CCP Encryption!", right?

Regards,

Dmitry.

[HeikoAnkenbrand]

Hi Dmitry,

Thanks, I made a mistake. That must be named ClusterXL:-)

Regards

Heiko

[Pasqual_Woodcoc]

Very nice feature. I have all cluster encrypted:-)

[Aviel_Ruijiling]

Is it possible to use certificates to protect ccp sessions.

[HeikoAnkenbrand]

I don't know that.

[Dmitry_Krupnik]

Hi Heiko,

I would to provide more information about the CCP encryption, could you update your article according to it.

The CCP Encryption:

• Supports SHA-256 encryption.
• Key replacement is done on every policy installation
• Encryption & decryption is done by CPU using AES-GCM to achieve minimal effect on performance.

You don't need to set key manually, it will be generated automatically and we recommend to use only this mode, at least because every policy installation will be generated new key (this option doesn't work if a key was set manually). The key can be set manually only as option for troubleshooting.

The CLISH commands:

• Toggle encryption mode: “set cluster member ccpenc <on/off>”
• Show encryption mode: “show cluster members ccpenc”

The commands under expert mode:

• Toggle encryption mode: "cphaconf ccp_encrypt <on/off>"
• Show encryption mode: "cphaprob ccp_encrypt"
• Display encryption key: "cphaprob ccp_encrypt_key"

Regards,

Dmitry.

[Dmitry_Krupnik]

Hi Aviel,

No, it isn't possible. In my opinion, we don't have a reason to use certificates here.

Regards,

Dmitry.

[Tim_Tielens]

What kind of performance impact are we talking about when enabling CCP encryption ?

It says: "minimal effect on performance"

But are there numbers available ?

[PhoneBoy]

The encryption/decryption is most likely using AES-NI instructions built into recent Intel processors.

On systems that don't have AES-NI instructions, I imagine the performance impact will be a bit more noticeable.

As for exact numbers, I don't think we can comment until after GA.

[HeikoAnkenbrand · Accepted solution]

Intel‘s AES New Instructions AES-NI is a encryption instruction set that improves on the Advanced Encryption Standard (AES) algorithm and accelerates the encryption of data in many processor familys.

Comprised of seven new instructions, AES-NI gives your environment faster, more affordable data protection and greater security.

You found more informations about AES NI here:

https://community.checkpoint.com/docs/DOC-3278-r80x-performance-tuning-tip-aes-ni

[Slavisa_Stojkov]

Can I change the encrytion algorithm. 

[Paul_Erez]

We use now the encryption. It works fine. 

Thanks

[Jernej_Bunic]

Unfortunately, it is no longer possible to analyze the CCP packets via "ccp_analyzer " when encryption is enabled.

Is there any other way to analyze CCP packets, or do I need to simply disable encryption when debugging clusterxl?

BR Jernej