Your VPN head-end keeps a weak legacy proposal enabled for devices that cannot be reconfigured. Who can select it?

## The thing that is actually configured When you "leave the old cipher on for the pumps", you have not configured the pumps. You have configured the **listener**. A VPN head-end holds a set of proposals it is willing to accept, and it applies that set to whatever arrives on the address and port it listens on. Nothing in that arrangement knows which caller is a clinical device and which is a stranger. The set is published, in effect, to everybody: a caller offers what it supports, the gateway agrees to something the two have in common, and if the only thing they have in common is the legacy transform, that is what the session runs on. So the honest statement of the exposure is not "the pumps are running weak crypto". It is: **the weak option is selectable by any caller that can reach the gateway, and it will keep being selectable for exactly as long as you need it for the fleet you cannot touch.** The overlap period is the exposure. That is what makes this a defender's problem rather than a protocol problem — the protocol is behaving correctly. ## What selecting it buys an adversary, and what it does not Be precise here, because both the overstatement and the understatement are common wrong answers. **It does not, by itself, open the door.** Confidentiality and integrity of the tunnel are one thing; admission is another. If the legacy proposal still requires an authentication credential the caller does not have, an arbitrary internet host that offers the weak transform still fails to establish a session. A weak transform is not an unauthenticated one. **But it weakens everything the legacy tunnels carry.** An adversary on the path, or one simply recording traffic now to work on later, gets a materially better position against those sessions than against the modern ones. Every device still on that set is contributing traffic to that pile, all day, because the estate is left connected all day. **And it frequently does open the door, for a reason specific to embedded fleets.** Vendor-shipped tunnel clients on pumps, imaging carts, PLC gateways and kiosks very often authenticate with a group secret that is identical across the whole shipment and lives in firmware on a device sitting in a public corridor. If your legacy proposal set is what keeps that authentication method acceptable, then anybody who pulls the secret out of one device can dial your head-end and be admitted as a member of that group. This is the version of the finding that gets a change request approved, and it is worth checking before you write the risk up as "confidentiality only". ## Why "only the pumps use it" is the wrong answer It confuses *who you intended to serve* with *who the configuration serves*. Three separate consequences of that confusion: - **Selection is the caller's move within your offer.** You control what is on the menu. You do not control who orders from it. - **The population using it is unknown until you measure it.** "The pumps" is an assumption. Gateways routinely turn out to be carrying a forgotten site-to-site tunnel, a contractor's laptop, a test rig, or a device class nobody in the room owns, all riding the same exception. - **The exception has no expiry of its own.** It was added for a migration and outlives the migration unless somebody attaches an owner and a date to it. ## What actually narrows it The fix that does not require the pumps to change is to stop offering the weak proposal on the surface everyone touches, and to offer it only where the peers that need it are bound: a per-peer or tunnel-group policy tied to peer identity, or a second listener on its own address or port reachable only from a known peer set. Both are ways of saying the same thing — the exception should be a property of a group, not of the front door. Meanwhile, treat the legacy tunnels as transport and not as trust. Terminate them somewhere narrow, allow them only the destinations those devices actually need, and put a date on the arrangement with a name against it. The devices cannot move; the blast radius can. ## What an interviewer is listening for That you separate the *negotiation surface* from the *fleet*, that you do not claim a weak cipher is an open door without checking the authentication method attached to it, that you know the group secret in embedded firmware is where this usually gets serious, and that your first move is to measure who is actually using the exception rather than to argue about the cipher.