topic Re: SSL/TLS Client-Initiated Renegotiation Vulnerability in NGFW LAN Int in Advanced Threat Prevention Discussions

SSL/TLS Client-Initiated Renegotiation Vulnerability in NGFW LAN Int

SubaMuthuram — Fri, 18 Feb 2022 18:53:46 GMT

Hi,

One of our runs vulnerability Assessment on LAN Interface of the PA NGFW, And they are getting SSL/TLS Client-Initiated Renegotiation vulnerability, Please help me to remediate the same.

Re: SSL/TLS Client-Initiated Renegotiation Vulnerability in NGFW LAN Int

Adrian_Jensen — Fri, 25 Feb 2022 15:31:42 GMT

You don't give much detail... but this is probably a renegotiation to lower TLS versions 1.0/1.1 that are vulnerable. Look at which SSL/TLS Profile you are using on your PA management interface:

Device -> Setup -> Management -> General Settings -> SSL/TLS Service Profile == <xxx>

Then make sure your SSL/TLS profile is set to minimum TLS 1.2 (Note: Some older apps/browsers may not be able to handle this, so check if you are using the SSL/TLS profile for something else as well). Update the SSL/TLS profile:

Device -> Certificate Management -> SSL/TLS Service Profile -> <xxx> -> Min Version = 1.2

Re: SSL/TLS Client-Initiated Renegotiation Vulnerability in NGFW LAN Int

SubaMuthuram — Tue, 29 Mar 2022 11:48:54 GMT

Thanks @Adrian_Jensen ,

I have resolved with the same way.

Re: SSL/TLS Client-Initiated Renegotiation Vulnerability in NGFW LAN Int

PatrickMurphy — Fri, 17 Jun 2022 13:45:39 GMT

Hmmm.. My scans still show this as an issue after applying these settings.

Re: SSL/TLS Client-Initiated Renegotiation Vulnerability in NGFW LAN Int

Adrian_Jensen — Fri, 17 Jun 2022 17:53:25 GMT

Do you have multiple certificate SSL/TLS profiles and you are alerting on one other than associated with the management port? I.e. a different profile for your GlobalProtect Portals and Gateways which are not a minimum of TLS>=1.2?