topic Re: Disable ciphers in General Topics

Disable ciphers

JingKai — Tue, 16 Aug 2022 08:50:56 GMT

Hi guys,

Would like to know how to disable the following ciphers:

TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA

Can i follow the following KB to disable:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC

Protocol settings is at TSLv1.0

Or i can GUI and disable the ciphers from ssl/tls service profile ?

Also, i want to know if i need to disable SSL/TSL on panorama ?

If yes, is it using the above KB mentioned?

Re: Disable ciphers

Han.Valk — Wed, 17 Aug 2022 18:51:37 GMT

Yes, you can use that article. I would use the following commands to achieve the best possible score on SSL Labs that you can get with a Palo Alto fw which is A-:

configure
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings auth-algo-sha1 no
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings enc-algo-3des no
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings enc-algo-aes-128-cbc no
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings enc-algo-aes-256-cbc no
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings enc-algo-rc4 no
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings keyxchg-algo-rsa no
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings auth-algo-sha256 yes
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings auth-algo-sha384 yes
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings enc-algo-aes-128-gcm yes
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings enc-algo-aes-256-gcm yes
set shared ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings keyxchg-algo-dhe yes

commit

@palo Alto: When will you fix the Secure Renegotiation issue?

Re: Disable ciphers

JingKai — Thu, 18 Aug 2022 04:21:33 GMT

Hi Han.Valk,

Thanks for the solution. But what about panorama?

Is it set panorama ssl-tls-service-profile <SSL/TLS Service Profile> protocol-settings?