R81.10 cipher_util issue

[G_W_Albrecht]

cipher_util does no longer work for multiportal in R81.10, look for yourself:

- start cipher_util

- display multiportal cipher list

- disable one cipher

- display cipher list shows the cipher as disabled

- quit cipher_util and type y save:

Would you like to save configuration? [y/N] y

Successfuly reconfigured 

Exiting cipher tool...

- start cipher_util

- display multiportal cipher list

---> you will see that nothing was changed and cipher_util has not saved the changes !

[matangi]

Hi @G_W_Albrecht 

Thank you for raising this issue

We are aware of this issue and working on a fix, will be released in R81.20 once the tests are completed successfully

• cipher_util tool works as expected for HTTPS Inspection
• A valid Workaround of changing ciphers for Multi-portal is to install policy by running "fw fetch local" on the Gateway right after "save configuration" step

Thanks,
Matan

[G_W_Albrecht]

Replicated issue and workaround on R81.10 and R80.40 GWs. Is there an SK for this issue already ?

[G_W_Albrecht]

Is it correct that this issue also is present in R81 @matangi ?

[matangi · Accepted solution]

Hi @G_W_Albrecht 
Yes, issue is present in R80.40 and higher releases

We created a new SK for that matter, see https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&so...

Thanks,
Matan

[the_rock]

Good job! Just tested with that sk and worked like a charm.

[chuck]

Hi @matangi 

Got the same problem in our upgrade from R80.30 to R81.10.

We tried the workaround in sk178165, does not seem to work.

The only difference from the workaround is that after "Multi Portal" a got to select "TLS 1.2 Ciphers"

Thanks 

[matangi]

Thanks @chuck 
In case the problem persists, Please open a service request to Check Point Support

[the_rock]

Indeed...tested on R80.40 and above, same issue. On R80.30, works fine.

Andy