topic Re: disable SSL V.3 in General Topics

disable SSL V.3

Satish — Wed, 28 Jan 2015 17:29:53 GMT

Hi Friends,

how we can disable SSL V.3 only for management console on PA firewall.

Regards

Satish

Re: disable SSL V.3

HULK — Wed, 28 Jan 2015 17:53:44 GMT

Hello Satish,

SSL V3 option has been removed from the PAN OS 6.0.8 and 6.1.2 onward. Prior to these version, you do not have any option to disable SSL V3 on the firewall, rather, you may disable SSL-V3 on your web browser. Accordingly, the client will not send SSL-v3 during the handshake.

You may go through the security advisory for more detail information: SSL 3.0 MITM Attack (CVE-2014-3566) (PAN-SA-2014-0005) a.k.a. POODLE

Below mentioned BUG has been fixed on PAN OS 6.0.8.

71321—Removed support for SSL 3.0 from the GlobalProtect gateway, GlobalProtect portal, and Captive Portal due to CVE-2014-3566 (POODLE).

71320—Removed support for SSL 3.0 from the web interface due to CVE-2014-3566 (POODLE).

Hope this helps.

Thanks

Re: disable SSL V.3

HULK — Wed, 28 Jan 2015 17:57:47 GMT

Look into the SSL 3.0 MITM Attack (CVE-2014-3566)

Thanks

Re: disable SSL V.3

hshah — Wed, 28 Jan 2015 18:53:03 GMT

Hi Satish,

If firewall is not on the latest code, than you can not disable SSLv3.

However, there is one work around if management traffic is going through data plane. In that case through custom signature SSLv3 traffic can be blocked.

Regards,

Hardik Shah

Re: disable SSL V.3

HULK — Wed, 28 Jan 2015 19:01:36 GMT

Hello Hardik,

Even in latest code, we have removed the SSL v3 from the code for management connection including GlobalProtect gateway, GlobalProtect portal, and Captive Portal. There is no such option or button to enable/disable SSL V3. Secondly, if you create a custom signature to block SSL V3 connection and the client keep initiating SSL V3 connection, then you will not be able to establish a connection, which would be a major black-hole.

So, custom signature would not be a recommended solution for production environment.

Hope this helps.

Thanks

Re: disable SSL V.3

ASCIT — Thu, 29 Jan 2015 01:09:27 GMT

When will 6.1.2 be released?

Re: disable SSL V.3

HULK — Thu, 29 Jan 2015 02:48:24 GMT

Hello ascit,

The PAN OS version 6.1.2 is expected to be released during the week of February 2, 2015.

Thanks

Re: disable SSL V.3

Satish — Thu, 29 Jan 2015 04:04:51 GMT

Hi.

Thanks Hulk & Hardik for reply.

Regards

Satish