topic Re: How to disable ssl v3 on vpn web page? in General Topics

How to disable ssl v3 on vpn web page?

choff123 — Fri, 27 Mar 2015 15:49:12 GMT

scanned the PA webserver we use for our VPN portal with qualys ssl scanner. Got a grade of F. Suggested to disable ....

Diffie-Hellman (DH) key exchange
512-bit export suites
Ssl v2 and v3

how can I go about doing this?

Re: How to disable ssl v3 on vpn web page?

rrajendran — Fri, 27 Mar 2015 16:16:14 GMT

Hi Choff,

According to me, there isn't any option for disabling DH key exchange and 512-bit suites. You can only avoid using them. However, if you have configured IPSEC VPN, you would have to use any one of the DH group while choosing your IKE proposals.

Also, there is no option to disable SSLV2 AND V3, but due to issues related to CVE-2015-0204, our firewall stopped supporting SSLV3 from 6.0.8 and 6.1.2.

Hope this is helpful.

Regards,

Ramya

Re: How to disable ssl v3 on vpn web page?

hshah — Fri, 27 Mar 2015 17:28:24 GMT

Hi Choffr,

You can not disable any encryption algorithm on PANW firewall. You can either disable on client or server.

You can block it via custom application/signature, but its not going to help. Because client will keep on try to connect on those algorithms which will result in failure attempts.

Regards,

Hardik Shah

Re: How to disable ssl v3 on vpn web page?

Satish — Fri, 27 Mar 2015 17:33:40 GMT

Hi Choffr,

I am agree with Hardik.

tnx

Satish