topic Encryption mode between 6.0 and 9.1 in General Topics

Encryption mode between 6.0 and 9.1

TonyTam — Fri, 10 Dec 2021 16:21:13 GMT

My company are going to migrate upgrade one firewall from 6.0 to 10.1.

And I found below KB points out the supported payload options above and below PANOS 7.0.

Several IKE/IPSec profiles are using aes128 for ESP encryption, is it aes128 equal to aes-128-cbc?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClYtCAK

PAN-OS 5.0 and above	PAN-OS 7.0 and above
aes128	aes-128-cbc

Re: Encryption mode between 6.0 and 9.1

OtakarKlier — Fri, 10 Dec 2021 21:52:46 GMT

Hello,

You also have aes-128-gcm which is different. Not sure how many PAN's you have to upgrade, however it seems like it might be a large-ish project. However version 6 is way low and vulnerable so its worth it to upgrade sooner rather than later.

Regards,

Re: Encryption mode between 6.0 and 9.1

TonyTam — Sat, 11 Dec 2021 01:53:52 GMT

The project size is only one small office and with several VPN connections and will be migrated to PA-410.

In current I added aes-128-cbc & aes-128-gcm to IPSec crypto for prevention payload issues.

Re: Encryption mode between 6.0 and 9.1

OtakarKlier — Mon, 13 Dec 2021 21:08:32 GMT

Hello,

If you plan on using the machine learning capabilities of the PAN for the remote office, I would suggest a PA-440 instead. The 410 has limitations even with logging. Check out the requirements.

Regards,