> Source: [sk126613](https://support.checkpoint.com/results/sk/sk126613) # sk126613 - Cipher configuration tool 'cipher_util' for Security Gateways | Property | Value | |----------|-------| | Solution ID | sk126613 | | Date Created | 2018-05-10 | | Last Modified | 2025-12-04 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Solution **Table of Contents:** * Introduction * Instructions for R80.30 and above * Instructions for R80.20 * Instructions for R80.10 * Known Limitations * Troubleshooting Show the Entire Article ### Introduction {#Introduction} With the Cipher Configuration tool "**cipher_util**" on a Security Gateway, you can configure the ciphers the Security Gateway accepts for the SSL connections. The "**cipher_util** " tool replaced the "`vpn cipher_util`" and "`vpn cu`" commands (which are no longer supported from R80.30). Show / Hide this section Procedure: 1. Connect to the command line on the Security Gateway / each Cluster Member. 2. Log in to the Expert mode. 3. On a VSX Gateway / VSX Cluster Member, go to the context of the applicable Virtual System: **vsenv \** 4. Run: **cipher_util** 5. Select the applicable option. ### Instructions for R80.30 and above {#R8030} Show / Hide this section In R80.30 and above, the tool offers the new ability to manage ciphers from its menu interactively, without manually editing configuration files on the Security Gateway. **New Features:** * Configure each feature's ciphers independently: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk126613/11811060852.PNG) * Print all the currently configured ciphers. * Enable/Disable the ciphers, control the ciphers the Security Gateway accepts or ignores in the SSL connection. * Change the order of ciphers by priority. If the Security Gateway does not support a cipher, then the Security Gateway ignores it. * Save or discard changes on exit. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk126613/21811060853.PNG) **Notes:** * To delete a character in the tool's shell, press the **CTRL + BACKSPACE** keys. * Before you configure ciphers for a feature, you must enable and configure the feature on the Security Gateway. * To apply a configuration to multiple Security Gateways: * On R81 and above: 1. Copy these files to the *$FWDIR/conf/* directory: 1. *multi_portal_cipher_priority.conf* 2. *ssl_inspection_cipher_priority.conf* 2. Restart Check Point services (in a cluster, this can cause a failover): `cprestart` * On R80.30 and R80.40: 1. Copy these files to the *$CPDIR/conf/* directory: 1. *multi_portal_cipher_priority.conf* 2. *ssl_inspection_cipher_priority.conf* 2. Restart Check Point services: `cprestart` Note - Do **not** edit these \*.conf files manually. * The 'cipher_util' tool is now enabled by default. * To *disable* the tool, run: **ckp_regedit -a SOFTWARE/CheckPoint/FW1 enable_cipher_configuration 0** * To *enable* the tool again, run: **ckp_regedit -a SOFTWARE/CheckPoint/FW1 enable_cipher_configuration 1** * The "**cipher_util** " tool replaced the **vpn cipher_util** and **vpn cu** commands (which are no longer supported). * **After each change in the cipher configuration, you must install the Access Control policy on the Security Gateway / Cluster.** ### Instructions for R80.20 {#R8020} Show / Hide this section In R80.20, you can now configure ciphers used by **SSL Inspection** (in addition to Multi-Portal ciphers). #### To enable the feature: {#Toggle_R8020} 1. Connect to the command line on the Security Gateway / each Cluster Member. 2. Log in to the Expert mode. 3. Create the required file in the *$CPDIR/conf/* directory: * For SSL Inspection, create this file: **touch $CPDIR/conf/wstlsd_cipher_priority.conf** * For Multi-Portal, create this file: **touch $CPDIR/conf/vpn_cipher_priority.conf** 4. Run this command to start the informative tool: **vpn cipherutil** The command shows the cipher configuration and the *\*.conf* file scheme you must use in your *\*.conf* file. 5. Edit the applicable *\*.conf* file to contain these ciphers: * For SSL Inspection: **vi $CPDIR/conf/wstlsd_cipher_priority.conf** * For Multi-Portal: **vi $CPDIR/conf/vpn_cipher_priority.conf** Ciphers: ``` ( :allowed ( : (TLS_RSA_WITH_AES_128_GCM_SHA256) : (TLS_RSA_WITH_AES_128_CBC_SHA) : (TLS_RSA_WITH_AES_256_CBC_SHA) : (TLS_RSA_WITH_AES_256_GCM_SHA384) : (TLS_RSA_WITH_AES_256_CBC_SHA256) : (TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) : (TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256) : (TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) : (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) : (TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) : (TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) : (TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) : (TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA) : (TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) : (TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) : (TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384) : (TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) ) :forbidden ( : (TLS_RSA_WITH_RC4_128_SHA) : (TLS_RSA_WITH_RC4_128_MD5) : (TLS_RSA_WITH_3DES_EDE_CBC_SHA) ) ) ``` Notes: * The file content is case-sensitive. * The "`:allowed`" section contains the ciphers the Security Gateway will accept (priority is from top to bottom). * The "`:forbidden`" section contains the ciphers the Security Gateway will not accept (if no allowed ciphers are offered by the source, the SSL connection will fail). Important - Add the forbidden ciphers explicitly in the "`:forbidden`" section. 6. Save the changes in the file and exit Vi editor. 7. Enable the 'cipher_util' tool: **ckp_regedit -a SOFTWARE/CheckPoint/FW1 enable_cipher_configuration 1** 8. In SmartConsole, install the Access Control policy on the Security Gateway / Cluster. **Important Notes:** * If there is a syntax error in the *\*.conf* file, then the Security Gateway ignores this file. * New supported ciphers have been added to R80.20 that do not exist in R80.10. For optimal functionality, check the updated list in the 'cipher_util' tool. * Each Software Blade has its configuration file. Applying changes to one Software Blade does affect other Software Blades. * After policy installation, only Software Blades with the existing *\*.conf* files are updated. Otherwise, the default supported configuration applies. * If a cipher exists in the *\*.conf* file, but the Security Gateway does not support it, then the Security Gateway ignores it. * If a cipher does not exist in the *\*.conf* file, and the Security Gateway supports it, then the Security Gateway first uses the ciphers that exist in the file, and only then uses other supported ciphers. ### Instructions for R80.10 {#R8010} Show / Hide this section In R80.10, you can control ciphers for Multi-Portal that listens on the TCP port 443: * Mobile Access Portal (SSLVPN) * Data Loss Prevention Portal (DLPSenderPortal) * Gaia Portal * UserCheck Portal * Identity Awareness Captive Portal (NAC) #### To enable the feature: {#Toggle_R8010} 1. Connect to the command line on the Security Gateway / each Cluster Member. 2. Log in to the Expert mode. 3. Create the *$CPDIR/conf/vpn_cipher_priority.conf* file: **touch $CPDIR/conf/vpn_cipher_priority.conf** 4. Edit the *$CPDIR/conf/vpn_cipher_priority.conf* file to contain these ciphers: **vi $CPDIR/conf/vpn_cipher_priority.conf** Ciphers: ``` ( :allowed ( : (TLS_RSA_WITH_AES_128_GCM_SHA256) : (TLS_RSA_WITH_AES_128_CBC_SHA) : (TLS_RSA_WITH_AES_256_CBC_SHA) : (TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) : (TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA) : (TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) : (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) : (TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) : (TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) ) :forbidden ( : (TLS_RSA_WITH_RC4_128_SHA) : (TLS_RSA_WITH_RC4_128_MD5) : (TLS_RSA_WITH_3DES_EDE_CBC_SHA) ) ) ``` Notes: * The file content is case-sensitive. * The "`:allowed`" section contains the ciphers the Security Gateway will accept (priority is from top to bottom). * The "`:forbidden`" section contains the ciphers the Security Gateway will not accept (if no allowed ciphers are offered by the source, the SSL connection will fail). Important - Add the forbidden ciphers explicitly in the "`:forbidden`" section. 5. Save the changes in the file and exit Vi editor. 6. Enable the 'cipher_util' tool: **ckp_regedit -a SOFTWARE/CheckPoint/FW1 enable_cipher_configuration 1** 7. In SmartConsole, install the Access Control policy on the Security Gateway / Cluster. **Important Notes:** * If there is a syntax error in the *\*.conf* file, then the Security Gateway ignores this file. * Each Software Blade has its configuration file. Applying changes to one Software Blade does affect other Software Blades. * After policy installation, only Software Blades with the existing '\*.conf' files are updated. Otherwise, the default supported configuration applies. * If a cipher exists in the *\*.conf* file, but the Security Gateway does not support it, then the Security Gateway ignores it. * If a cipher does not exist in the *\*.conf* file, and the Security Gateway supports it, then the Security Gateway first uses the ciphers that exist in the file, and only then uses other supported ciphers. #### Important Information: * This procedure is not relevant for SSL Inspection. * If there is a syntax error in the *\*.conf* file, then the Security Gateway ignores this file. * If a cipher exists in the *\*.conf* file, but the Security Gateway does not support it, then the Security Gateway ignores it. * If a cipher does not exist in the *\*.conf* file, and the Security Gateway supports it, then the Security Gateway first uses the ciphers that exist in the file, and only then uses other supported ciphers. ### Known Limitations {#Known Limitations} Show / Hide this section |------------|-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Issue | Version | Symptom | Solution | | PMTR-76030 | * R81.10 * R81 | Error "*Cannot access features configuration directory* " when running the `cipher_util` command in the context of a Virtual System other than VS0 on a VSX Gateway / VSX Cluster Member. | This problem was fixed. The fix is included starting from: * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 55 * [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 68 | | PMTR-60845 | * R81.10 * R81 * R80.40 | The configuration made with the 'cipher_util' on a Security Gateway is not applied immediately after modifying Multi-Portal ciphers | This problem was fixed. The fix is included starting from: * **[Check Point R81.20](https://support.checkpoint.com/results/sk/sk173903)** See [sk178165](https://support.checkpoint.com/results/sk/sk178165) for more information. | ### Troubleshooting {#Troubleshooting} Show / Hide this section 1. Connect to the command line on the Security Gateway / each Cluster Member. 2. Log in to the Expert mode. 3. Enable the VPN debug: **vpn debug trunc \& vpn debug on TDERROR_ALL_ALL=5** 4. Install the Access Control policy. 5. Stop the VPN debugs: **vpn debug off \& vpn debug ikeoff** 6. Analyze the **$FWDIR/log/vpnd.elg\*** file. Search for **cptls_params_reorder_ciphers** and check that the cipher list is accepted by the Security Gateway / Cluster Member. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content