cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

R80.30 - ClusterXL CCP Encryption!

Under R80.30 it is possible to encrypt CCP traffic.  This is very useful to protect the cluster from manipulated CCP packets.  Therefore new commands have been implemented on the CLI for this purpose. The following description shows you how to enable CCP encryption. All settings you make on the CLI are permanently stored in the following file “/etc/fw.boot/ha_boot.conf”.  This means that all settings are preserved after the reboot. You have to set the settings on both gateways and they will take effect on the fly. The CCP encryption is disabled by default and must be enabled via CLI on both gateways.

 

The CCP Encryption:

  • Supports SHA-256 hash.
  • Key replacement is done on every policy installation
  • Encryption & decryption is done by CPU using AES-GCM to achieve minimal effect on performance.

 

Example commands:

 

# cphaprob ccp_encrypt         

clish> show cluster members ccpenc

 

 

With the following command the encryption can be permanently enabled on the fly:

# cphaconf ccp_encrypt on


In this way the encryption can be disabled on the fly

# cphaconf ccp_encrypt off

 

With this command you can test if the CCP encryption works. Here you should not see any cluster status information on the sync interface (blue). All packages should be visible under unknown when CCP encryption is enabled.

# tcpdump -nepi eth1 -x port -s 0 8116 2>/dev/null | ccp_analyzer -g –c

 

Unfortunately it is no longer possible to analyze the CCP packets via "ccp_analyzer " when encryption is enabled.

 

The CLISH commands:

  • Toggle encryption mode: “set cluster member ccpenc <on/off>”
  • Show encryption mode: “show cluster members ccpenc”


The commands under expert mode:

  • Toggle encryption mode: "cphaconf ccp_encrypt <on/off>"
  • Show encryption mode: "cphaprob ccp_encrypt"
  • Display encryption key: "cphaprob ccp_encrypt_key

 

 

More interesting articles: cp.ankenbrand24.de

13 Replies

Re: R80.30 - ClusterXL CCP Encryption!

Is this already available with R80.20?

Re: R80.30 - ClusterXL CCP Encryption!

Hi Sabine,

Only R80.30+

Re: R80.30 - ClusterXL CCP Encryption!

nice

Employee+
Employee+

Re: R80.30 - ClusterXL CCP Encryption!

Hi Heiko,

Thank you, that share this information with CheckMates. Did you mean "R80.30 - ClusterXL CCP Encryption!", right? Smiley Happy

Regards,

Dmitry.

Re: R80.30 - ClusterXL CCP Encryption!

Hi Dmitry,

Thanks, I made a mistake. That must be named ClusterXL:-)

Regards

Heiko

Re: R80.30 - ClusterXL CCP Encryption!

Is it possible to use certificates to protect ccp sessions.

Re: R80.30 - ClusterXL CCP Encryption!

I don't know that.

Employee+
Employee+

Re: R80.30 - ClusterXL CCP Encryption!

Hi Heiko,

I would to provide more information about the CCP encryption, could you update your article according to it.


The CCP Encryption:

  • Supports SHA-256 encryption.
  • Key replacement is done on every policy installation
  • Encryption & decryption is done by CPU using AES-GCM to achieve minimal effect on performance.


You don't need to set key manually, it will be generated automatically and we recommend to use only this mode, at least because every policy installation will be generated new key (this option doesn't work if a key was set manually). The key can be set manually only as option for troubleshooting.


The CLISH commands:

  • Toggle encryption mode: “set cluster member ccpenc <on/off>”
  • Show encryption mode: “show cluster members ccpenc”


The commands under expert mode:

  • Toggle encryption mode: "cphaconf ccp_encrypt <on/off>"
  • Show encryption mode: "cphaprob ccp_encrypt"
  • Display encryption key: "cphaprob ccp_encrypt_key"

Regards,

Dmitry.

Employee+
Employee+

Re: R80.30 - ClusterXL CCP Encryption!

Hi Aviel,

No, it isn't possible. In my opinion, we don't have a reason to use certificates here.

Regards,

Dmitry.

Re: R80.30 - ClusterXL CCP Encryption!

What kind of performance impact are we talking about when enabling CCP encryption ?

It says: "minimal effect on performance"

But are there numbers available ?

0 Kudos
Admin
Admin

Re: R80.30 - ClusterXL CCP Encryption!

The encryption/decryption is most likely using AES-NI instructions built into recent Intel processors.

On systems that don't have AES-NI instructions, I imagine the performance impact will be a bit more noticeable.

As for exact numbers, I don't think we can comment until after GA.

Highlighted

Re: R80.30 - ClusterXL CCP Encryption!

Intel‘s AES New Instructions AES-NI is a encryption instruction set that improves on the Advanced Encryption Standard (AES) algorithm and accelerates the encryption of data in many processor familys.

Comprised of seven new instructions, AES-NI gives your environment faster, more affordable data protection and greater security.

You found more informations about AES NI here:

https://community.checkpoint.com/docs/DOC-3278-r80x-performance-tuning-tip-aes-ni

Re: R80.30 - ClusterXL CCP Encryption!

Can I change the encrytion algorithm.