- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Under R80.30 it is possible to encrypt CCP traffic. This is very useful to protect the cluster from manipulated CCP packets. Therefore new commands have been implemented on the CLI for this purpose. The following description shows you how to enable CCP encryption. All settings you make on the CLI are permanently stored in the following file “/etc/fw.boot/ha_boot.conf”. This means that all settings are preserved after the reboot. You have to set the settings on both gateways and they will take effect on the fly. The CCP encryption is disabled by default and must be enabled via CLI on both gateways.
The CCP Encryption:
Example commands:
# cphaprob ccp_encrypt
clish> show cluster members ccpenc
With the following command the encryption can be permanently enabled on the fly:
# cphaconf ccp_encrypt on
In this way the encryption can be disabled on the fly
# cphaconf ccp_encrypt off
With this command you can test if the CCP encryption works. Here you should not see any cluster status information on the sync interface (blue). All packages should be visible under unknown when CCP encryption is enabled.
# tcpdump -nepi eth1 -x port -s 0 8116 2>/dev/null | ccp_analyzer -g –c
Unfortunately it is no longer possible to analyze the CCP packets via "ccp_analyzer " when encryption is enabled.
The CLISH commands:
The commands under expert mode:
More interesting articles: cp.ankenbrand24.de
Intel‘s AES New Instructions AES-NI is a encryption instruction set that improves on the Advanced Encryption Standard (AES) algorithm and accelerates the encryption of data in many processor familys.
Comprised of seven new instructions, AES-NI gives your environment faster, more affordable data protection and greater security.
You found more informations about AES NI here:
https://community.checkpoint.com/docs/DOC-3278-r80x-performance-tuning-tip-aes-ni
Is this already available with R80.20?
To further clarify, CCP encryption is enabled by default on R80.30 Gaia kernel version 3.10 only. CCP encryption is disabled by default on R80.30 Gaia kernel version 2.6.18. See sk162358: R80.30 cluster, with CCP Encryption enabled, managed by an R80.10 Security Management come... Just noticed this difference in my lab and could not figure out what was going on until I found that SK.
Also tagging @PhoneBoy with this follow-up question: If CCP encryption is enabled it impacts both CCP traffic emanating out all clustered interfaces presenting a Cluster IP, and the CCP traffic on the sync interface, correct? Is there any way to disable CCP encryption just for the state sync traffic (FWHAP_SYNC) yet leave it enabled for all the clustered interfaces presenting a Cluster IP? My guess is no, but if one has a crossover cable connecting the sync ports in a 2-member cluster, it would be nice to save the overhead involved encrypting/decrypting that heavy sync traffic if the sync network is known to be secure. Securing CCP on the cluster interfaces is still very important of course since they are accessible to the surrounding networks.
Yes I suppose someone could vampire into the sync cable and mess with the cluster if the sync network CCP traffic is not encrypted, but if the attacker already has physical access to your cluster and the sync cable you've got much bigger problems afoot...
nice
Hi Heiko,
Thank you, that share this information with CheckMates. Did you mean "R80.30 - ClusterXL CCP Encryption!", right?
Regards,
Dmitry.
Very nice feature. I have all cluster encrypted:-)
Is it possible to use certificates to protect ccp sessions.
Hi Heiko,
I would to provide more information about the CCP encryption, could you update your article according to it.
The CCP Encryption:
You don't need to set key manually, it will be generated automatically and we recommend to use only this mode, at least because every policy installation will be generated new key (this option doesn't work if a key was set manually). The key can be set manually only as option for troubleshooting.
The CLISH commands:
The commands under expert mode:
Regards,
Dmitry.
Hi Aviel,
No, it isn't possible. In my opinion, we don't have a reason to use certificates here.
Regards,
Dmitry.
What kind of performance impact are we talking about when enabling CCP encryption ?
It says: "minimal effect on performance"
But are there numbers available ?
The encryption/decryption is most likely using AES-NI instructions built into recent Intel processors.
On systems that don't have AES-NI instructions, I imagine the performance impact will be a bit more noticeable.
As for exact numbers, I don't think we can comment until after GA.
Intel‘s AES New Instructions AES-NI is a encryption instruction set that improves on the Advanced Encryption Standard (AES) algorithm and accelerates the encryption of data in many processor familys.
Comprised of seven new instructions, AES-NI gives your environment faster, more affordable data protection and greater security.
You found more informations about AES NI here:
https://community.checkpoint.com/docs/DOC-3278-r80x-performance-tuning-tip-aes-ni
Can I change the encrytion algorithm.
We use now the encryption. It works fine.
Thanks
Unfortunately, it is no longer possible to analyze the CCP packets via "ccp_analyzer " when encryption is enabled.
Is there any other way to analyze CCP packets, or do I need to simply disable encryption when debugging clusterxl?
BR Jernej
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY