For those that seek to get SSH Proxy working

Han.Valk — Tue, 07 Jan 2025 07:39:28 GMT

Searching the internet it seems that people are looking to enable SSH Proxy and not finding answers. I managed to get it working but must say that the current supported SSH decrytion parameters for all PAN-OS versions aren't the most secure ones so you should consider what's more important for your situation:

SSH inspection with less secure SSH configuration.
No SSH inspection with robust SSH parameters.

Environment:

PAN-OS 11.1.X
OpenSSH 9.X
Bitvise SSH Client 9.X

sshd_config on a Linux box so that SSH decryption will be possible:

Ciphers aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha1
HostKeyAlgorithms ssh-rsa
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
RequiredRSASize 2048

I use the free Windows Bitvise client because it allows to customize the SSH parameters.

Decryption profile:

Decryption policy:

Result:

Regards,

Han.

Re: For those that seek to get SSH Proxy working

JayGolf — Tue, 07 Jan 2025 21:54:23 GMT

@Han.Valk ,

Thank you for sharing!

topic For those that seek to get SSH Proxy working in General Topics

For those that seek to get SSH Proxy working

Re: For those that seek to get SSH Proxy working