topic In Wildfire how do we disable weak TLS ciphers? in General Topics

In Wildfire how do we disable weak TLS ciphers?

pjohnson1 — Mon, 29 Aug 2022 01:49:52 GMT

Nessus scanning is picking up TCP/443 TLS v1.0 and v1.1 on our WildFire (WF-500) appliances.

Is there a way to turn off TLS v1.0 and v1.1 on the WildFire ?

Below is the Nessus scanner notification.

--------------------------------------------------------------------------------
Policy Violation 443/tcp Nessus ID: 56984
--------------------------------------------------------------------------------
Synopsis :
The remote service encrypts communications.

Description :
This plugin detects which SSL and TLS versions are supported by the
remote service for encrypting communications.

See also :

Solution :
n/a

Risk factor :
None / CVSS Base Score :0.0

Prioritized Risk :
None (VPR: n/a / CVSS v3: None / CVSS v2: None)

Plugin output :

This port supports TLSv1.0/TLSv1.1/TLSv1.2.

Re: In Wildfire how do we disable weak TLS ciphers?

nikoolayy1 — Tue, 30 Aug 2022 06:29:15 GMT

Hello,

Please see the article below and set the min TLS version you want:

https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/set-up-and-manage-a-wildfire-appliance/set-up-authentication-using-custom-certs-standalone-wildfire-appliance/configure-authentication-with-custom-certificates-on-wf-500

---

- PAN-OS 8.0 and later releases support TLS 1.2 and later TLS versions only. You must set the max version to TLS 1.2 or max.
  
  admin@WF-500#
  set shared ssl-tls-service-profile
  <name>protocol-settings min-version {tls1-0 | tls1-1 | tls1-2}
  
  admin@WF-500#
  set shared ssl-tls-service-profile
  <name>protocol-settings max-version {tls1-0 | tls1-1 | tls1-2 | max}
- Configure secure server communication on the WildFire appliance.
  
  Set the SSL/TLS profile. This SSL/TLS service profile applies to all SSL connection between WildFire and client devices.
  
  admin@WF-500#
  set deviceconfig setting management secure-conn-server ssl-tls-service-profile
  <ssltls-profile>

Re: In Wildfire how do we disable weak TLS ciphers?

S.Ramesh960545 — Mon, 17 Feb 2025 06:35:47 GMT

how does this disable weak ciphers?