Blocking old SSL/TLS Versions on GW

[SomAustrianCity]

Hi

I'm in the process of implementing HTTPS Inspection on my border Gateway, and while i'm at it, i'd like to block old Versions of SSL and TLS.
On one hand, it may be possible to disable them in the inspection deamon - but in case some software is so old that it still needs them, i need a way to still allow them.

Now if i could do that using IPS, i'd have a policy where i can set exceptions and allow specifically these. And also i could enforce it on uninspected traffic (like when certifcate pinning is used, or client-cert-authentication)

But looking through the IPS Database, i got confused. There are two sets of Protection, which would allow me to do that? But i don't understand, where's the difference? And why are the new ones so bad in comparsion to the older ones? (when looking at performance and confidence)

As info, i want to use outgoing (internal client to internet) and incoming (internet to dmz webserver) inspection.

Transport Layer Security (TLS) Version 1.0
Transport Layer Security (TLS) is a cryptographic protocol meant to provide security and data integrity for communications over TCP/IP networks. TLSv1.0 is considered obsolete and insecure, and is deprecated in favor of a more advanced TLS protocol. This protection will detect and block any use of TLSv1.0 protocol.
Protected Asset: BOTH
Last Update: 2019-01-02
Released: 2016-10-20
Performance Impact: 4/5
Confidence Level: 2/3

Transport Layer Security (TLS) Version 1.1
Transport Layer Security (TLS) is a cryptographic protocol meant to provide security and data integrity for communications over TCP/IP networks. TLSv1.1 is considered obsolete and insecure, and is deprecated in favor of a more advanced TLS protocol. This protection will detect and block any use of TLSv1.1 protocol.
Protected Asset: BOTH
Last Update: 2019-01-02
Released: 2016-10-20
Performance Impact: 4/5
Confidence Level: 2/3

Transport Layer Security (TLS) Version 1.2
Transport Layer Security (TLS) is a cryptographic protocol meant to provide security and data integrity for communications over TCP/IP networks. This protection will detect and block any use of TLSv1.2 protocol.
Protected Asset: BOTH
Last Update: 2019-01-02
Released: 2016-10-20
Performance Impact: 4/5
Confidence Level: 2/3

SSLv3 Deprecated Version
Secure Sockets Layer (SSL) is cryptographic protocols that provide security for communications over networks such as the Internet. SSL encrypts the segments of network connections at the Application Layer to ensure secure end-to-end transit at the Transport Layer. SSL version 3 is an older implementation of the protocol which is still commonly used. Only SSLV3 will be detected by this detection.
Protected Asset: CLIENT
Last Update: 2023-03-22
Released: 2023-03-22
Performance Impact: 5/5
Confidence Level: 1/3

TLSv1.0 Deprecated Version
Secure Sockets Layer (SSL) is cryptographic protocols that provide security for communications over networks such as the Internet. SSL encrypts the segments of network connections at the Application Layer to ensure secure end-to-end transit at the Transport Layer. SSL version 3 is an older implementation of the protocol which is still commonly used. Only TLS1.0 Server Hello will be detected by this detection.
Protected Asset: CLIENT
Last Update: 2023-03-22
Released: 2023-03-22
Performance Impact: 5/5
Confidence Level: 1/3

TLSv1.1 Deprecated Version
Secure Sockets Layer (SSL) is cryptographic protocols that provide security for communications over networks such as the Internet. SSL encrypts the segments of network connections at the Application Layer to ensure secure end-to-end transit at the Transport Layer. SSL version 3 is an older implementation of the protocol which is still commonly used. Only TLS1.1 Server Hello will be detected by this detection.
Protected Asset: CLIENT
Last Update: 2023-03-22
Released: 2023-03-22
Performance Impact: 5/5
Confidence Level: 1/3

Thank you

[PhoneBoy]

You can also potentially use App Control to do it also: https://support.checkpoint.com/results/sk/sk112249

[SomAustrianCity]

Thanks for the Hint, but that doesn't work - at least not as i would like it.

To write it down, my design goals are as following: Allowing http and http access to the internet, on any port. But all traffic shoutld be inspected via https inspection and IPS, to protect my network.

At the same time, old TLS versions should be blocked - unless specifically allowed.

With that in mind, i made a few tests. As test commands, i used curl:

curl -k --tlsv1.0 --tls-max 1.0 https://tls-v1-0.badssl.com:1010/
curl -k --tlsv1.1 --tls-max 1.1 https://tls-v1-0.badssl.com:1010/
curl -k --tlsv1.2 --tls-max 1.2 https://tls-v1-0.badssl.com:1010/

curl -k --tlsv1.0 --tls-max 1.0 https://tls-v1-1.badssl.com:1011/
curl -k --tlsv1.1 --tls-max 1.1 https://tls-v1-1.badssl.com:1011/
curl -k --tlsv1.2 --tls-max 1.2 https://tls-v1-1.badssl.com:1011/

curl -k --tlsv1.0 --tls-max 1.0 https://tls-v1-2.badssl.com:1012/
curl -k --tlsv1.1 --tls-max 1.1 https://tls-v1-2.badssl.com:1012/
curl -k --tlsv1.2 --tls-max 1.2 https://tls-v1-2.badssl.com:1012/ 

These are my conclusions:

Client	Service/Application Object	SSL Inspection	IPS Protections	tls-v1-0.badssl.com	tls-v1-1.badssl.com	tls-v1-2.badssl.com	Behaviour	Conclusion
Client TLS 1.0 Only	Simple HTTPS-Protocol Object	no	no	yes	no (log: allow)	no (log: allow)	Expected behaviour	Undesired
Client TLS 1.1 Only	Simple HTTPS-Protocol Object	no	no	no (log: allow)	yes	no (log: allow)	Expected behaviour	Undesired
Client TLS 1.2 Only	Simple HTTPS-Protocol Object	no	no	no (log: allow)	no (log: allow)	yes	Expected behaviour	Undesired
Client TLS 1.0 Only	Port 1010: Block via TLS10 Protocol Port 1011: Block via TLS11 Protocol Port 1011: Allow via HTTPS Protocol	no	no	no (log: reject)	no (log: reject)	no (log: reject)	Expected behaviour	Undesired
Client TLS 1.1 Only	Port 1010: Block via TLS10 Protocol Port 1011: Block via TLS11 Protocol Port 1011: Allow via HTTPS Protocol	no	no	no (log: reject)	no (log: reject)	no (log: reject)	Expected behaviour	Undesired
Client TLS 1.2 Only	Port 1010: Block via TLS10 Protocol Port 1011: Block via TLS11 Protocol Port 1011: Allow via HTTPS Protocol	no	no	no (log: allow)	no (log: allow)	yes	Expected behaviour	Undesired
Client TLS 1.0 Only	Port 1010: Block via TLS10 Protocol Port 1011: Block via TLS11 Protocol Port 1011: Allow via HTTPS Protocol	Port 1010: Inspect via HTTPS Protocol Port 1011: Inspect via HTTPS Protocol Port 1011: Inspect via HTTPS Protocol	no	no (log: reject)	yes	yes	Unexpected Yes with 1.1	Undesired
Client TLS 1.1 Only	Port 1010: Block via TLS10 Protocol Port 1011: Block via TLS11 Protocol Port 1011: Allow via HTTPS Protocol	Port 1010: Inspect via HTTPS Protocol Port 1011: Inspect via HTTPS Protocol Port 1011: Inspect via HTTPS Protocol	no	yes	no (log: reject)	yes	Unexpected Yes with 1.0	Undesired
Client TLS 1.2 Only	Port 1010: Block via TLS10 Protocol Port 1011: Block via TLS11 Protocol Port 1011: Allow via HTTPS Protocol	Port 1010: Inspect via HTTPS Protocol Port 1011: Inspect via HTTPS Protocol Port 1011: Inspect via HTTPS Protocol	no	yes	yes	yes	Unexpected Yes with 1.0 and 1.1	Undesired
Client TLS 1.0 Only	Simple HTTPS-Protocol Object	no	Old Protections active	yes	no (log: allow)	no (log: allow)	Unexpected Yes with 1.0, No IPS blocks	Undesired
Client TLS 1.1 Only	Simple HTTPS-Protocol Object	no	Old Protections active	no (log: allow)	yes	no (log: allow)	Unexpected Yes with 1.1, No IPS blocks	Undesired
Client TLS 1.2 Only	Simple HTTPS-Protocol Object	no	Old Protections active	no (log: allow)	no (log: allow)	yes	No IPS blocks	Undesired
Client TLS 1.0 Only	Simple HTTPS-Protocol Object	no	New Protections active	yes	no (log: allow)	no (log: allow)	Unexpected Yes with 1.0, No IPS blocks	Undesired
Client TLS 1.1 Only	Simple HTTPS-Protocol Object	no	New Protections active	no (log: allow)	yes	no (log: allow)	Unexpected Yes with 1.1, No IPS blocks	Undesired
Client TLS 1.2 Only	Simple HTTPS-Protocol Object	no	New Protections active	no (log: allow)	no (log: allow)	yes	No IPS blocks	Undesired

Even if i include the Port s1010 to 1012 under "Manage & Settings / Application Control & URL Filtering / Advanced Settings / Application Control Web Browsing Services", the IPS never blocks my connections. So somethings not working there, at least not on non-default ports, even though i used objects with protocols.

Blocking via tcp/https object works, as long as i don't use ssl inspection. Once i turn on inspection - which i want, to filter urls and viruses - blocking

I had the best results with this tests, but even here the TLS1.2 Server was reachable with a TLS1.1 client (with HTTPS Inspection). It's a better result than other, but i'd prefer all clients to use 1.2 or 1.3, and no version below.

Client TLS 1.0 Only	Port 1010: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1011: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1012: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol	Port 1010: Inspect via HTTPS Protocol Port 1011: Inspect via HTTPS Protocol Port 1012: Inspect via HTTPS Protocol	no	no	no	no	Expected behaviour	Desired
Client TLS 1.1 Only	Port 1010: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1011: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1012: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol	Port 1010: Inspect via HTTPS Protocol Port 1011: Inspect via HTTPS Protocol Port 1012: Inspect via HTTPS Protocol	no	no	no	yes	Unexpected Yes with 1.2	Undesired
Client TLS 1.2 Only	Port 1010: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1011: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1012: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol	Port 1010: Inspect via HTTPS Protocol Port 1011: Inspect via HTTPS Protocol Port 1012: Inspect via HTTPS Protocol	no	no	no	yes	Expected behaviour	Desired
Client TLS 1.0 Only	Port 1010: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1011: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1012: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol	no	no	no	no	no	Expected behaviour	Desired
Client TLS 1.1 Only	Port 1010: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1011: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1012: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol	no	no	no	no	no	Expected behaviour	Desired
Client TLS 1.2 Only	Port 1010: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1011: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol Port 1012: Block via TLS10 and TLS11 Protocol; Allow via HTTPS Protcol	no	no	no	no	yes	Expected behaviour	Desired

One last info, my Gateway is running R81.10 HFA81

[SomAustrianCity]

**bleep**, i messed up the tests with IPS Protections - one should also install the IPS Policy, when activating protections, otherwise it won't  work...

Please see my revised table for IPS protections: The old protections work, but only when not inspecting the traffic. Once i inspect the traffic, the Protections stop working. Also, the new protections don't work, or at least not as well as the old ones.

Client TLS 1.0 Only	Simple HTTPS-Protocol Object	no	Old Protections active	no	no	no	Expected behaviour	Desired
Client TLS 1.1 Only	Simple HTTPS-Protocol Object	no	Old Protections active	no	no	no	Expected behaviour	Desired
Client TLS 1.2 Only	Simple HTTPS-Protocol Object	no	Old Protections active	no	no	yes	Expected behaviour	Desired
Client TLS 1.0 Only	Simple HTTPS-Protocol Object	no	New Protections active	yes	no	no	Unexpected Yes with 1.0	Undesired
Client TLS 1.1 Only	Simple HTTPS-Protocol Object	no	New Protections active	no	yes	no	Unexpected Yes with 1.1	Undesired
Client TLS 1.2 Only	Simple HTTPS-Protocol Object	no	New Protections active	no	no	yes	Expected behaviour	Desired
Client TLS 1.0 Only	Simple HTTPS-Protocol Object	Simple HTTPS-Protocol Object	Old Protections active	yes	yes	yes	Unexpected Yes with wrong protocols	Undesired
Client TLS 1.1 Only	Simple HTTPS-Protocol Object	Simple HTTPS-Protocol Object	Old Protections active	yes	yes	yes	Unexpected Yes with wrong protocols	Undesired
Client TLS 1.2 Only	Simple HTTPS-Protocol Object	Simple HTTPS-Protocol Object	Old Protections active	yes	yes	yes	Unexpected Yes with wrong protocols	Undesired
Client TLS 1.0 Only	Simple HTTPS-Protocol Object	Simple HTTPS-Protocol Object	New Protections active	yes	yes	yes	Unexpected Yes with wrong protocols	Undesired
Client TLS 1.1 Only	Simple HTTPS-Protocol Object	Simple HTTPS-Protocol Object	New Protections active	yes	yes	yes	Unexpected Yes with wrong protocols	Undesired
Client TLS 1.2 Only	Simple HTTPS-Protocol Object	Simple HTTPS-Protocol Object	New Protections active	yes	yes	yes	Unexpected Yes with wrong protocols	Undesired

My conclusion so far:

Uninspected Traffic: In can block via IPS or Service-Objects.

Inspected Traffic: I can block 1.0 and 1.1 Servers, but only 1.0 Clients. Not Ideal, but better than nothing.

Does anyone have other ideas, how i could achieve blocking 1.0 and 1.1 in all cases?

[G_W_Albrecht]

What did you configure for https inspection in cipher_util (sk126613: Cipher configuration tool 'cipher_util' for Security Gateways) ?

[SomAustrianCity]

Yeah, i already disabled the 3DES and RC4 Ciphers there. Disabling CBC is on my roadmap, but less important than other steps.

If i disable 1.0 and 1.1 in the inspection daemon, then sure, all inspected traffic has to be 1.2 or it won't work. But that also means, if there is an old application (or server) that doesn't support 1.2 yet, i have to disable inspection for that connection. Not ideal 😞

Hm, yeah i could disable these ciphers. Accoring to ssllabs, these are used in 1.0 and 1.1 connections

# TLS 1.1 (suites in server-preferred order)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)
TLS_RSA_WITH_AES_256_CBC_SHA (0x35)

# TLS 1.0 (suites in server-preferred order)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)
TLS_RSA_WITH_AES_256_CBC_SHA (0x35)

[PhoneBoy]

A similar issue was discussed here with HTTPS Inspection: https://community.checkpoint.com/t5/General-Topics/Disable-TLS-1-0/m-p/70338#M14237

[SomAustrianCity]

Hi

Ok, so with the commands from https://community.checkpoint.com/t5/General-Topics/Disable-TLS-1-0/m-p/70338#M14237, i can disable old Versions in the HTTPS Inspection deamon, blocking said versions when inspecting.

And in case i'm not inspecting, i can either use a blocking rule with TLS1.0 and TLS1.1 Objects, or use the old IPS Patterns to block these TLS HELLOs. 

Great, thank you.

[PhoneBoy]

I will warn you that the older protections for this are marked with performance impact critical (5/5).
This means that traffic subject to these protections will be processed in the slow (F2F) path.
Be aware of this if you notice any performance issues after enabling them.