AES_GCM on ATP-Series

Tunox

Dear Zyxel-Team,

in the near Future a Phone-Provider we have an VPN Connection to, tolds me in December, that we urgently should update our Connection from AES_CBC to AES_GCM.

We use a ATP700 with the latest Update installed (5.41). Is there a Chance, that Zyxel provides GCM in an further Update ?

Thx

Gordon

Zyxel_Melen

Hi @Tunox

After checking with our product team, the ATP series, also USG FLEX series, won't implement AES_GCM.

If you have this requirement, we recommend migrating to USG FLEX H series.

https://www.zyxel.com/global/en/products/next-gen-firewall/usg-flex-firewall-usg-flex-700h

Zyxel_Melen

Hi @Tunox

After checking with our product team, the ATP series, also USG FLEX series, won't implement AES_GCM.

If you have this requirement, we recommend migrating to USG FLEX H series.

https://www.zyxel.com/global/en/products/next-gen-firewall/usg-flex-firewall-usg-flex-700h

mMontana

Is available the technical reason why AES-GCM won't be implemented, as cypher, on Flex series?

Zyxel_Melen

Hi @mMontana

For ZLD (USG FLEX/ATP), we are not able to add AES-GCM-256 support, due to the fact that the underlying VPN turnkey does NOT support the algorithm and migrating to a newer version turnkey is not an option on this platform.

mMontana

…because the updated version of turnkey is available on newer devices, Flex H.

I hope there won't be from third parties (like PCI-DSS) a "ban" for device having only AES_CBC as available protocol.
Could hit some nerve at budget levels…