Disable CBC mode cipher and enable GCM cipher mode for https inspection

[TG_Mai]

hello 

we have R80.10 with https inspection on, does anyone know how to disable the CBC mode cipher for TLS_ECDHE_RSA * in the https inspection?

There an SK show how to allow specific cipher suites only for VPN in R80.10

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

any help would be great, thank you.

TG

[PhoneBoy]

See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
Note that if you're using HTTPS Inspection, it's a good idea to upgrade to R80.30 as it supports additional ciphers, has a better utility to configure what it supported/allowed, and improved SNI support.

[Suresh_Kumar]

We have already on R80.30 and we are facing the same issue that the all CBC Cipher are showing enable for all the application.

Is there any way to restrict ciphers for specific natted IP?

[Zatimus]

Hi Suresh,

Hope you are doing well. Want to ask, you manage to have your questions answered? if you do could you share with me the steps.

Thank you

[G_W_Albrecht]

A good starting point is sk104562: Supported cipher suites for HTTPS Inspection that lists supported ciphers for many versions. Then use sk126613: Cipher configuration tool for Security Gateways to configure it as requested.

[tavi0906]

is there any way to block the CBC ciphers on a NAT ip

[G_W_Albrecht]

Please explain - what is a NAT IP for you? Usually, allowed ciphers can be set for SSH, SSL VPN and Multiportal.