Forcing AES encryption Algorithm for SNX user

[JaeYoung_An]

Hi, Expert.

I would like to force AES for SNX user?

 I’ve tried many ways, but user is keep using 3DES only. Can we force AES?

 

I’ve also followed https://support.checkpoint.com/results/sk/sk113114 to disable 3DES, but always 3DES is used.

This is same even in latest version.

Can anyone Advise how to use AES or confirm we can’t use AES?

[PhoneBoy]

What precisely are the clients in this case?
If they're Linux, I suspect you're out of luck similar to: https://support.checkpoint.com/results/sk/sk180837 
Windows and macOS SNX support AES on currently supported versions.

[JaeYoung_An]

It's Windows 10 client with chrome browser

gateway version is R81.20

please refer to below pic

[PhoneBoy]

You may want to make 100% certain 3DES is disabled globally per: https://support.checkpoint.com/results/sk/sk113114
Otherwise, I suggest a TAC case to assist: https://help.checkpoint.com 

[Massimo_Manzato]

sk116156 https://support.checkpoint.com/results/sk/sk116156  tell AES is supported by MacOS SNX client starting from R80.10

this obviously suggest that the SNX Server side support this encryption method  as showed here:

Why this is not working ?

if I use SNX client or CAPSULE from windows the connections is always in 3DES.

there is a Check Point Employee that can explain how to solve  using GuiDBEDIT?

thanks

Massimo

[PhoneBoy]

Don't know that (gui)dbedit is the solution here.
I know this SK only mentions SMB appliances, but I see the referenced kernel variable on regular gateways (at least in R82): https://support.checkpoint.com/results/sk/sk112314
It's worth a shot.