Product concerned: SNS 4.2 and higher versions
Last update: December 2021
The Enable “ANSSI Diffusion Restreinte (DR)” mode option forces the firewall to comply with the ANSSI’s (French national information security agency) recommendations on the use of coprocessors and cryptographic accelerators on products to be qualified. It is an imperative on networks that fall under the “Restricted” mention.
This mode relies in particular on the use of software versions for asymmetric and symmetric cryptographic algorithms and random key generation algorithms. As for symmetric encryption algorithms, "AES-NI" instructions available on certain products (SNi20, SNi40, SN510, SN710, SN910, SN2000, SN2100, SN3000, SN3100, SN6000 et SN6100) are exempt as they are made up only of “simple acceleration instructions” of certain cryptographic operations.
The ANSSI Diffusion Restreinte (DR) mode in SNS 4.2 versions and higher is not compatible with DR mode in earlier SNS versions.
Likewise, a firewall in DR mode cannot set up IPsec VPN tunnels with an SNS firewall or third-party device in “standard” IPsec mode.