Blocking TLS Connections

You can block inbound TLS 1.0 and TLS 1.1 connections through a Security Gateway to internal networks, and outbound TLS 1.0 and TLS 1.1 connections from internal networks to a Security Gateway.

Prerequisites

Procedure

  1. Use SmartConsole to connect to the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or the Domain Management Server that manages this Security Gateway.

  2. In the top-right corner in SmartConsole, click Objects and the icon, which opens the Object Explorer window.

  3. In the top search field, search for:

    tls

  4. To block TLS 1.0 connections:

    1. Right-click the predefined service tls1.0, and click Clone.

      The New TCP Service window opens.

    2. In the Name field, change the name from tls1.0_Clone to the required name.

      For example: tls1.0_Block

    3. Optional: In the Comment field, enter the applicable text.

      For example: User-defined service to block TLS 1.0 connections

    4. In the left panel, click Advanced.

    5. In the top section, select Protocol Signature.

    6. Click OK.

  5. To block TLS 1.1 connections:

    1. Right-click the predefined service tls1.1, and click Clone.

      The New TCP Service window opens.

    2. In the Name field, change the name from tls1.1_Clone to the required name.

      For example: tls1.1_Block

    3. Optional: In the Comment field, enter the applicable text.

      For example: User-defined service to block TLS 1.1 connections.

    4. In the left panel, click Advanced.

    5. In the top section, select Protocol Signature.

    6. Click OK.

    Example result:

  6. Close the Object Explorer window.

  1. In SmartConsole, go to the Gateways & Servers view.

  2. Double-click the applicable Security Gateway or Security Cluster object.

    The Security Gateway or Security Cluster editor opens.

  3. In the General Properties page, go to the Network Security tab.

  4. Select the Application ControlClosed Software Blade on a Check Point Firewall that allows granular control over specific web-enabled applications by using deep packet inspection. Acronym: APPI. Software BladeClosed Specific security solution (module): (1) On a Check Point Firewall, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities..

  5. Click OK.

  1. In the top left corner of SmartConsole, click , and select Manage policies and layers.

  2. Right-click the applicable policy that you installed on the Security Gateway or Security Cluster > click Edit.

  3. In the Access Control row, click in the top right corner, and select Edit Layer.

  4. On the General page, in the Blades section, select Application & URL Filtering.

  5. Click OK to close the Layer Editor window.

  6. Click OK to close the Policy window.

  7. Close the Manage policies and layers window.

  1. In the left navigation panel in SmartConsole, click Security Policies.

  2. In the Access Control section, click Policy.

  3. Add the applicable new rules to block TLS 1.0 and TLS 1.1 connections:

    Name

    Source

    Destination

    VPN

    Services & Applications

    Content

    Action

    Track
    Block TLS 1.0 Applicable Source Applicable Destination *Any

    User-defined services

    tls1.0_Block

    		*Any Drop Log or None
    Block TLS 1.1 Applicable Source Applicable Destination *Any

    User-defined services

    tls1.1_Block

    		*Any Drop Log or None

  4. Publish the session.

  5. Install the Access Control policy on the Security Gateway or Security Cluster object.