topic Re: What SSL/TLS versions are allowed for WEBUI in General Topics

What SSL/TLS versions are allowed for WEBUI

TSPphooper — Tue, 14 Jan 2014 15:27:47 GMT

Hello,

I'm trying to verify which SSL/TLS versions and Ciphers the PANs accept for WEBUI connections. Specifically I am trying to verify that it does not accept connections using weaker Protocols or Cipers and if it is configurable.

Please note that this is for Management connections to the PANs only, not user traffic.

Any help would be appreciated.

Thanks.

Re: What SSL/TLS versions are allowed for WEBUI

HULK — Tue, 14 Jan 2014 15:53:18 GMT

Hello Sir,

To log into the firewall, the browser must be TLS 1.0 compatible.

Ciphers suits for Admin Sessions (web interface):

DHE-RSA-AES256-SHA

RSA-AES256-SHA

DHE-RSA-CAMELLIA256-SHA

RSA-CAMELLIA256-SHA

EDH-RSA-3DES-SHA

RSA-3DES-SHA (aka RSA-DES-CBC3-SHA aka DES-CBC3-SHA)

DHE-RSA-AES128-SHA

RSA-AES128-SHA

DHE-RSA-SEED-SHA

RSA-SEED-SHA

DHE-RSA-CAMELLIA128-SHA

CAMELLIA128-SHA

RSA-RC4-SHA

RSA-RC4-MD5

For data-plane traffic, The SSL versions supported by PAN-OS are: SSLv3, TLS1.0, and TLS1.1.

Hope it will help you.

Thanks

Re: What SSL/TLS versions are allowed for WEBUI

TSPphooper — Wed, 15 Jan 2014 16:56:30 GMT

Thank you very much for the Reply.

Is TLS 1.0 the only protocol that can be used for the Management Interface? Older protocols such as SSLv2 will be denied and are not supported? I suspect the answer is yes but need to verify.

Re: What SSL/TLS versions are allowed for WEBUI

HULK — Wed, 15 Jan 2014 18:19:40 GMT

Yes, you are correct.

Re: What SSL/TLS versions are allowed for WEBUI

HULK — Wed, 15 Jan 2014 20:24:23 GMT

Hello Sir,

I did a small test with IE to open WEBUI for PAN-FW management interface. It is working only with SSL 3.0 and TLS 1.0.

Thanks

Re: What SSL/TLS versions are allowed for WEBUI

mikand — Tue, 21 Jan 2014 08:34:55 GMT

According to the release notes for PANOS 6.0 most devices will now support TLS 1.2 for dataplane ssl/tls decryption.

Re: What SSL/TLS versions are allowed for WEBUI

HULK — Tue, 21 Jan 2014 15:32:20 GMT

Hello Mikand,

You are correct, The new PAN OS 6.0 is having capability to decrypt TLS 1.2. Although PANOS 5.0, if we detect a TLS1.1 or TLS1.2 session, we first try to downgrade it to TLS1.0 and decrypt. If that fails, we won't decrypt the session and either drop the session or allow it encrypted based upon your policy settings.

Thanks

Re: What SSL/TLS versions are allowed for WEBUI

mbavishi — Mon, 20 Oct 2014 20:01:49 GMT

Hello Hulk,

Is there a way to block sslv3 access to management interface of the firewall and allow only TLS1.0 ?

Thanks.

Re: What SSL/TLS versions are allowed for WEBUI

hshah — Mon, 20 Oct 2014 22:10:54 GMT

Hi Mbavishi,

Latest content has fix for vulnerability related sslv3, if management traffic is traversing through the Dataports than it can blocked.

If not, there is no way to block it.

Regards,

Hardik Shah

Re: What SSL/TLS versions are allowed for WEBUI

hshah — Mon, 20 Oct 2014 22:29:23 GMT

Hi Mbavishi,

Please refer following thread for more detail.

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

Regards,

Hardik Shah