> Source: [sk67100](https://support.checkpoint.com/results/sk/sk67100)

# sk67100 - Microsoft KB2585542 (BEAST attack response) causes Mobile Access portal / SSL VPN portal to be inaccessible

| Property | Value |
|----------|-------|
| Solution ID | sk67100 |
| Date Created | 2012-02-15 |
| Last Modified | 2017-01-24 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Any website that does not support RC4 encryption, does not come up via Mobile Access portal / SNX portal when using Internet Explorer.

* The same web sites come up via Mobile Access portal / SNX portal when using older Chrome or Firefox version 9 (or below) browsers.

* Enabling RC4 for Mobile Access portal / SNX portal on the Mobile Access Gateway resolves the issue.

* Issue occurs on Mobile Access Gateway versions R70.x / R71.x.

## Cause

[Microsoft KB2585542](https://technet.microsoft.com/en-us/library/security/ms12-006) changes how Microsoft Internet Explorer processes the SSL handshake. Since this change affects much more than the Check Point SNX portal based on a quick Google search, Microsoft may release their own fix for this issue.

In addition, this patch for [Beast attack (CVE-2011-3389)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk86440) was also implemented in Chrome updates and Firefox version 10 (and above).

## Solution

**Solution:**

This problem was fixed. The fix is included in:

* [Check Point R75.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk67581) and above

Check Point recommends to always upgrade to the most recent version ([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=73) / [upgrade Cluster](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=428) / [upgrade VSX](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=359) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [upgrade Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166) / [upgrade SmartConsole](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=191)).

For **other [supported](http://www.checkpoint.com/support-services/support-life-cycle-policy/index.html) versions** , [Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) can supply a **Hotfix** .  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPInfo files](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) from the Security Management Server and Mobile Access Gateways involved in the case.

**Workarounds:**

* On Windows XP and Windows 7 with SSL Network Extender client:

  * You may use a different browser other than Internet Explorer, such as Firefox below version 10.

  * You may disable TLS 1.0 support the Internet Explorer browser:

    Go to "Tools" menu - click on "Internet Options -\> go to "Advanced" tab -\> clear the box "TLS 1.0" at the bottom - click on OK - close the Internet Explorer - open the Internet Explorer.

    TLS 1.2 and TLS 1.3 may be checked for other applications, which will use those protocols. Leaving TLS 1.2 and 1.3 checked will not affect SSL Network Extender.
* On Windows XP with SSL Network Extender client:

  The encryption parameters can be changed in Check Point SmartDashboard - Global Properties:

  Enable RC4 (or AES on newer versions) as an optional encryption algorithm for SSL Network Extender (SNX):

  In SmartDashboard, go to "Policy" menu - click on "Global Properties..." -\> expand "Remote Access" -\> click on "SSL Network Extender" -\> in the "Encryption" section, in the "Supported encryption methods" field, select either "3DES, RC4" or "AES, 3DES, RC4" (depends on the SmartDashboard version) - click on OK - install policy

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content