topic Re: filter ssh v1 in General Topics

filter ssh v1

Cesar.pevezFajardo — Tue, 06 Mar 2012 13:28:01 GMT

I have a request to filter in the firewall ssh v1. Is there any way to identify and filter ssh v1? can the firewall identify ssh v2 some way?

Re: filter ssh v1

gafrol — Tue, 06 Mar 2012 13:55:18 GMT

Hi Cesar,

ssh is at least listed in the applipedia as a known App.

http://apps.paloaltonetworks.com/applipedia/

rgds Roland

Re: filter ssh v1

Cesar.pevezFajardo — Tue, 06 Mar 2012 14:09:05 GMT

Thanks Roland

The problem I have is that I don't see any reference to the version of SSH in the app description. I will like to know if there is any mechanism to diferentiate v1 from v2, so I can permit only v1.

Re: filter ssh v1

gafrol — Tue, 06 Mar 2012 14:16:16 GMT

It seems the APP does not differentiate between ssh1 and ssh2, just my guess....

Roland

Re: filter ssh v1

mikand — Tue, 06 Mar 2012 14:25:53 GMT

You can setup a SSH decryption policy to handle ssh vs ssh-tunnel. But I dont think it currently supports stuff like v1 vs v2.

Look at page 143 in the PA-4.1_Administrators_Guide.pdf for more info.

I think you need to contact your sales rep. to file this as a feature request.

Re: filter ssh v1

emr_1 — Wed, 07 Mar 2012 05:31:42 GMT

I can see 'SSH2 Login Attempt' (ID:31914) under vulnerability protection signature.

If you permit ssh in security rule and block this signature on the same rule,

can't you permit ssh v1 only?

Just my guess.

Regards,

Emr