RE: [FW1] Mixing DES levels?

["Jeff Hochberg" <jhochberg@FW1-NOSPAMearthlink.net>]

The only reason why I pointed out the modifications to the control.map file
is because I've run into situations where a customer will have enterprise
encryption center and for some reason or another purchased a module with no
encryption.  In the past, if you were using a management station that had
encryption and trying to manage a module with no encryption at all, I needed
to modify the control.map (per Frank's recommendation; I used to work with
him) to reduce or eliminate the encrypted channel between the management and
module.

I didn't take offense, I appreciate the constructive criticism.  I guess I
just wasn't clear enough as to which encryption scenario I was talking
about.

-Jeff

-----Original Message-----
From: CryptoTech [mailto:cryptotech@gmx.de]
Sent: Saturday, November 11, 2000 8:54 AM
To: jhochberg@earthlink.net
Cc: 'Tom Sevy'; 'Check Point FW List (E-mail)'
Subject: Re: [FW1] Mixing DES levels?


Not true Jeff.  As a matter of fact, and I think Frank will concur, you
should never
change the control.map file unless you are quite certain of the
repercussions.  The
control.map file determines if FWA1, FWN1, or SSL, or (god forbid, NONE is
the
chosen secure transmission method between modules.

What you will need to do is to edit that vpn rules encryption method by
right
clicking on the 'Encrypt' action and selecting edit under the IKE tab.  Then
select
DES as the Encrypt Transform.

It is a very common thing to do what you are asking.

HTH,
CryptoTech

PS.  Please do not take offense Jeff.  I am not questioning your expertise,
just
indicating my companies policy with regard to firewalls.

Jeff Hochberg wrote:

> I think Frank already answered this question....
>
> No that's not a problem.  Depending on what encryption level you are
running
> on the Nokia, you may have to modify the control.map file to change which
> encryption scheme is used between the management and that module when
> pushing a policy or logging back to the management.
>
> Jeffrey Hochberg
> Digital Stronghold
> jhochberg@earthlink.net
>
> -----Original Message-----
> From: owner-fw-1-mailinglist@lists.us.checkpoint.com
> [mailto:owner-fw-1-mailinglist@lists.us.checkpoint.com]On Behalf Of Tom
> Sevy
> Sent: Friday, November 10, 2000 4:24 PM
> To: 'Frank Darden'; Check Point FW List (E-mail)
> Subject: RE: [FW1] Mixing DES levels?
>
> Since this is an internal FW to protect us from our Vendors, we don't care
> much about encryption.  We won't be using it for any vpn.
>
> I just want to be sure that the 3Des Management Console won't complain
that
> it is talking to a lesser [encryption strength] Nokia IP box.
>
> -----Original Message-----
> From: Frank Darden [mailto:fdarden@locked.com]
> Sent: Friday, November 10, 2000 3:27 PM
> To: 'Tom Sevy'; Check Point FW List (E-mail)
> Subject: RE: [FW1] Mixing DES levels?
>
> Yes, you can mix DES as well as 3DES, and FWZ1. Youll set the encryption
> level on you action encrypt item in the rulebase.
>
> -----Original Message-----
> From: Tom Sevy [mailto:tsevy@epx.com]
> Sent: Friday, November 10, 2000 2:37 PM
> To: Check Point FW List (E-mail)
> Subject: [FW1] Mixing DES levels?
>
> We currently have two IP440's running 4.1 SP2 3Des.
>
> I need to add two new Firewalls (possible IP330, possible IP440) to
> segregate our network from a Vendor router segment (already throught about
> just making this another zone off of existing FW's, but decided to put in
> totally different new units for this task).
>
> Can the new one be less than 3Des?  Or does everything have to stay the
> same?
>
>
============================================================================
> ====
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
>
============================================================================
> ====
>
>
============================================================================
> ====
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
>
============================================================================
> ====
>
>
============================================================================
====
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
>
============================================================================
====




================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================