TLSv1.3 and Weak CBC Ciphers

[Sanjay_S]

Hi All,

We are planning to enable the inspection of TLSv1.3 on R81 gateways. I went through the below document to enable it but not really sure whether the interface IPs configured on firewalls will also be inspected with the TLSv1.3. Also may i know whether this will affect the TLSv1.2 traffic passing through the firewall once we enable this option?

HTTPS Inspection (checkpoint.com)

We are also planning to disable weak CBC ciphers but did not find any such documents related to disable. When it comes to Cisco ASA it can be done directly in ASDM but not finding any options in Checkpoint, could you please help me with any such documents which helps me with the configuration on removing the weak Ciphers?

Also will there be any impact other than not negotiating with the weak ciphers? Mainly when negotiating for the Remote Access VPN.

Regards,

Sanjay S

[PhoneBoy]

Different infrastructure needs to be enabled to inspect TLS 1.3.
It will also inspect TLS 1.2 and earlier. 

For the cipher question: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Sanjay_S]

Thank you PhoneBoy this really helps.

[Sanjay_S]

Hi PhoneBoy,

Is there any list of approved Ciphers by Checkpoint to use and weak ciphers list which we can disable?

Regards,

Sanjay S

[PhoneBoy]

Do we have a specific document? No.
The ciphers we have enabled by default should provide the best mix of usability and security.
Additional ones can be disabled based on your precise requirements.