Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
HeikoAnkenbrand
Champion Champion
Champion
Jump to solution

R80.30 - ClusterXL CCP Encryption!

Under R80.30 it is possible to encrypt CCP traffic.  This is very useful to protect the cluster from manipulated CCP packets.  Therefore new commands have been implemented on the CLI for this purpose. The following description shows you how to enable CCP encryption. All settings you make on the CLI are permanently stored in the following file “/etc/fw.boot/ha_boot.conf”.  This means that all settings are preserved after the reboot. You have to set the settings on both gateways and they will take effect on the fly. The CCP encryption is disabled by default and must be enabled via CLI on both gateways.

 

The CCP Encryption:

  • Supports SHA-256 hash.
  • Key replacement is done on every policy installation
  • Encryption & decryption is done by CPU using AES-GCM to achieve minimal effect on performance.

 

Example commands:

 

# cphaprob ccp_encrypt         

clish> show cluster members ccpenc

 

 

With the following command the encryption can be permanently enabled on the fly:

# cphaconf ccp_encrypt on


In this way the encryption can be disabled on the fly

# cphaconf ccp_encrypt off

 

With this command you can test if the CCP encryption works. Here you should not see any cluster status information on the sync interface (blue). All packages should be visible under unknown when CCP encryption is enabled.

# tcpdump -nepi eth1 -x port -s 0 8116 2>/dev/null | ccp_analyzer -g –c

 

Unfortunately it is no longer possible to analyze the CCP packets via "ccp_analyzer " when encryption is enabled.

 

The CLISH commands:

  • Toggle encryption mode: “set cluster member ccpenc <on/off>”
  • Show encryption mode: “show cluster members ccpenc”


The commands under expert mode:

  • Toggle encryption mode: "cphaconf ccp_encrypt <on/off>"
  • Show encryption mode: "cphaprob ccp_encrypt"
  • Display encryption key: "cphaprob ccp_encrypt_key

 

 

More interesting articles: cp.ankenbrand24.de

➜ CCSM Elite, CCME, CCTE
(1)
1 Solution

Accepted Solutions
HeikoAnkenbrand
Champion Champion
Champion

Intel‘s AES New Instructions AES-NI is a encryption instruction set that improves on the Advanced Encryption Standard (AES) algorithm and accelerates the encryption of data in many processor familys.

Comprised of seven new instructions, AES-NI gives your environment faster, more affordable data protection and greater security.

You found more informations about AES NI here:

https://community.checkpoint.com/docs/DOC-3278-r80x-performance-tuning-tip-aes-ni

➜ CCSM Elite, CCME, CCTE

View solution in original post

17 Replies
Sabine_Freimann
Participant

Is this already available with R80.20?

HeikoAnkenbrand
Champion Champion
Champion

Hi Sabine,

Only R80.30+

➜ CCSM Elite, CCME, CCTE
Timothy_Hall
Champion
Champion

To further clarify, CCP encryption is enabled by default on R80.30 Gaia kernel version 3.10 only.  CCP encryption is disabled by default on R80.30 Gaia kernel version 2.6.18.  See sk162358: R80.30 cluster, with CCP Encryption enabled, managed by an R80.10 Security Management come...  Just noticed this difference in my lab and could not figure out what was going on until I found that SK.

Also tagging @PhoneBoy with this follow-up question: If CCP encryption is enabled it impacts both CCP traffic emanating out all clustered interfaces presenting a Cluster IP, and the CCP traffic on the sync interface, correct?  Is there any way to disable CCP encryption just for the state sync traffic (FWHAP_SYNC) yet leave it enabled for all the clustered interfaces presenting a Cluster IP?  My guess is no, but if one has a crossover cable connecting the sync ports in a 2-member cluster, it would be nice to save the overhead involved encrypting/decrypting that heavy sync traffic if the sync network is known to be secure.  Securing CCP on the cluster interfaces is still very important of course since they are accessible to the surrounding networks.

Yes I suppose someone could vampire into the sync cable and mess with the cluster if the sync network CCP traffic is not encrypted, but if the attacker already has physical access to your cluster and the sync cable you've got much bigger problems afoot...

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
Armin__Alic
Participant

nice

Dmitry_Krupnik
Employee Alumnus
Employee Alumnus

Hi Heiko,

Thank you, that share this information with CheckMates. Did you mean "R80.30 - ClusterXL CCP Encryption!", right? Smiley Happy

Regards,

Dmitry.

HeikoAnkenbrand
Champion Champion
Champion

Hi Dmitry,

Thanks, I made a mistake. That must be named ClusterXL:-)

Regards

Heiko

➜ CCSM Elite, CCME, CCTE
Pasqual_Woodcoc
Explorer

Very nice feature. I have all cluster encrypted:-)

Aviel_Ruijiling
Explorer

Is it possible to use certificates to protect ccp sessions.

HeikoAnkenbrand
Champion Champion
Champion

I don't know that.

➜ CCSM Elite, CCME, CCTE
Dmitry_Krupnik
Employee Alumnus
Employee Alumnus

Hi Heiko,

I would to provide more information about the CCP encryption, could you update your article according to it.


The CCP Encryption:

  • Supports SHA-256 encryption.
  • Key replacement is done on every policy installation
  • Encryption & decryption is done by CPU using AES-GCM to achieve minimal effect on performance.


You don't need to set key manually, it will be generated automatically and we recommend to use only this mode, at least because every policy installation will be generated new key (this option doesn't work if a key was set manually). The key can be set manually only as option for troubleshooting.


The CLISH commands:

  • Toggle encryption mode: “set cluster member ccpenc <on/off>”
  • Show encryption mode: “show cluster members ccpenc”


The commands under expert mode:

  • Toggle encryption mode: "cphaconf ccp_encrypt <on/off>"
  • Show encryption mode: "cphaprob ccp_encrypt"
  • Display encryption key: "cphaprob ccp_encrypt_key"

Regards,

Dmitry.

Dmitry_Krupnik
Employee Alumnus
Employee Alumnus

Hi Aviel,

No, it isn't possible. In my opinion, we don't have a reason to use certificates here.

Regards,

Dmitry.

Tim_Tielens
Contributor

What kind of performance impact are we talking about when enabling CCP encryption ?

It says: "minimal effect on performance"

But are there numbers available ?

PhoneBoy
Admin
Admin

The encryption/decryption is most likely using AES-NI instructions built into recent Intel processors.

On systems that don't have AES-NI instructions, I imagine the performance impact will be a bit more noticeable.

As for exact numbers, I don't think we can comment until after GA.

HeikoAnkenbrand
Champion Champion
Champion

Intel‘s AES New Instructions AES-NI is a encryption instruction set that improves on the Advanced Encryption Standard (AES) algorithm and accelerates the encryption of data in many processor familys.

Comprised of seven new instructions, AES-NI gives your environment faster, more affordable data protection and greater security.

You found more informations about AES NI here:

https://community.checkpoint.com/docs/DOC-3278-r80x-performance-tuning-tip-aes-ni

➜ CCSM Elite, CCME, CCTE
Slavisa_Stojkov
Participant

Can I change the encrytion algorithm. 

Paul_Erez
Participant

We use now the encryption. It works fine. 

Thanks

0 Kudos
jb1
Contributor
Contributor

Unfortunately, it is no longer possible to analyze the CCP packets via "ccp_analyzer " when encryption is enabled.

 

Is there any other way to analyze CCP packets, or do I need to simply disable encryption when debugging clusterxl?

 

BR Jernej

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events