Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 7 replies
  • Subscribers 29 subscribers
  • Views 4640 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Connect using depreciated DH group?

AndersK

Hi,

I just noticed after upgrading XG to 17.5.3 MR-3 and Sophos Connect client to version 1.2 that Diffie Hellman group changed from ECP_256 to MODP_1024. Also the VPN profile is referencing MODP_1024.

MODP_1024 is weak and depreciated so I suppose this is a configuration flaw? Are there any configuration options for Sophos Connect to change DH group and maybe move from CBC to a modern GCM cipher?

 



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to RickardNordahl

    I'm using the same Sophos Connect version 1.2.5.0202. Both the VPN connection profile and Open VPN log points out MODP_1024 as DH group and updating the connection profile to MODP_2048 or ECP_256 makes no difference.

  • 0 in reply to AndersK

    Hello Anders,

     

    I do not understand your statement "updating the connection profile to MODP_2048 or ECP_256 makes no difference". Where are you updating this? Please let me know what is getting updated and where so I can help? Also any new connection imported in Sophos Connect 1.2 will use MODP_1024. If you have not imported the connection after you upgrade to Sophos Connect 1.2 it will still negotiate ECP_256.

     

    Ramesh

  • 0 in reply to rmk_95128

    Hi Ramesh,

    As part of the "troubleshooting" I tried to replace MODP_1024 in VPN connection profile Cisco_VPN.tgb.

    Why would Sophos move from ECP_256 to the depreciated MODP_1024?

    Anders

  • +2 in reply to AndersK

    Hello Anders,

    In the .tgb file you need to make this change in this line. Transforms = AES256-SHA2_256-GRP19-RSA_SIG

     

    Similarly for Phase 2 you need to change this line. Transforms = TGBQM-ESP-AES256-SHA2_256-PFSGRP19-TUN-XF

     

    This change will help to select the correct DH group. This is a problem with Sophos Connect 1.2 and it will be fixed in the next release and by default it will select ECP_256.

     

    Please let me know if you have any questions.

     

    Ramesh