0

I have a broad question, that i'm hoping you can guys help out with. I have a checkpoint firewall, that has the option to use ssl network extender checked in UI under VPN clients.

I've been asked by the upper management to un-check this option, but i'm not sure what impact would it have on the users that connect trough vpn? (they don't know either, but are pretty sure no users use it)

I'm totally new to checkpoint, and couldn't find in the documentation what impact will this have. Can you guys help out please?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15, 2019 at 2:23

1 Answer 1

1

The SSL Network Extender is an SSLVPN (A.K.A. a many-to-one VPN allowing access to your internal network from the internet, using SSL as the encapsulation; i.e. so employees can access network resources from home).

SSLVPN's are usually the simplest to configure, as they easily bypass NATs, usually appear as regular internet traffic to firewalls and content filters and therefore often don't need special rules added, and are relatively secure (if they use the right protocol: TLS1.2+, with TLS 1.3 being ideal but backwards compatibility to 1.2 still necessary, 1.1 only if very outdated clients are connecting; TLS1.1 being OK if configured to only use secure ciphers (no EXPORT, NULL cyphers try to avoid non-EC DSA and DES as well); TLS1.0 is not necessary unless you expect unupdated Win XP clients- probably not a good idea anyway; SSL3.0 should be avoided except in very rare instances and cyphers must be carefully chosen). SSLVPNs are also the most universal, as SSL (technically should be referred to TLS, if not too old, but TLS and SSL are used synonymously now, even though TLS, a.k.a. Transport layer security has almost completely replaced SSL, a.k.a. socket layer security, after heartbleed). Often SSLVPNs are simplest for the end users as well, since many NSA producers put out apps that allow one or two step configuration. In terms of security, overhead, robustness, etc., they are not the best option. I personally use L2TP with ESP encapsulated IPSec. If a NAT needs to be bypassed, then a custom Box with OpenVPN is a good option.

My guess might be that the reason they wanted you to disable the SSLVPN is that it probably uses an insecure protocol version like SSL3.0, or uses a protocol that is still used, like TLS1.1 or 1.0, but uses an insecure cypher with no way to change it, thus creating a major security hole or at least a security liability. They were probably instructed to do so by the manufacturer.

To see if anyone is using it, check the connection logs on the device. If they're not enabled, enable them. The SSLVPN will have a distinct set of internal IPs assigned to it, or an entire subnet (usually just an IP block though, since it's beneficial to stay on the main network except for special circumstances). IPs for connecting clients are also likely assigned by DHCP, so if you check the DHCP log, you can see if any DHCP requests came in on that interface.

Also, the SSLVPN uses a simple username/password access model. The user database can be stored via an external RADIUS accounting server, LDAP, and possibly Windows Active Directory. For simplicity however, it often uses the built in user database on the appliance. The same one you use to log into the admin interface also stores users with less privileges, such as SSLVPN access. If you have no external user directory configured with the appliance, and the only user in the built-in database is the admin account, then you know it is not used.

But once again, if you're unsure, the connection logs and the DHCP logs will shed light on any activity. The SSLVPN uses a virtual interface, first see what IPs its assigned and what its internal name is (like sslvpn0). Then use that info to figure out what's going on.

A final option would be to use an old hub to "tap" the line upstream of the appliance, and use a program like Wireshark to analyze the incoming packets, I believe Wireshark's heuristic disectors can pick out sslvpn traffic.

If you find it is in use, you'll likely need to explore other alternatives for a different many-to-one VPN solution. There are way too many to list but you can find everything from drop in solutions, to firmware for existing network infrastructure, to a custom configured server. You may also have an option for an IPSec VPN setup in that appliance already, depending on the model.

Then just post a notice instructing people to use the new VPN.

If no one is using it, just shut it off and go home for the day!

Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.