How to prevent TLS1.0 traffic passing through gateway using IPS

[Chandhrasekar_S]

Hello,

We are running CheckPoint R80.10 and have enabled IPS, Anti-Virus, Anti-Bot threat prevention blades. There is a requirement to block TLS1.0 traffic passing through the gateway. Just wondering how we can achieve this using our Threat Prevention blades.

Thanks,

Chandru

[Anthony_Nguyen]

You can enable the IPS protection "Transport Layer (TLS) Version 1.0" to block TLSv1.0:

[Chandhrasekar_S]

Thanks Anthony. Thats very helpful.

The requirement is to block TLS1.0 traffic for a particular subnet reaching an public IP address. Does it mean, I need to create a new rule under Threat Prevention policy specifying the source and destination with block on TLSv1.0  

[Vladimir]

You are better off creating this exception:

Otherwise, you'll have to create a separate profile with TLS 1.0 protection only and apply it to your desired scope.

[Chandhrasekar_S]

OK. Thanks Vladimir. This seems to be a possible solution

[Magnus-Holmberg]

Would SSL inspection be needed for this to actually work?

[Timothy_Hall]

Pretty sure the answer is no, as the client and server agree on SSL/TLS versions and cipher suites right at the start of the negotiations which are still in the clear, and the firewall should be able to inspect it without full HTTPS Inspection.