topic Re: Cipher suites decryption 7.1 in General Topics

Cipher suites decryption 7.1

Jack_Howells — Wed, 01 Jun 2016 09:40:38 GMT

Hi guys,

Configuring inbound SSL inspection on 7.1, decryption does not work with the newly supported cipher suites shown in the document below.

https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-Supported-ciphers/ta-p/71969

Only the cipher suites shown in the document below again work. The document above states that ECDHE should work but it does not.

https://live.paloaltonetworks.com/t5/Management-Articles/SSL-Decryption-Not-Working-due-to-Unsupported-Cipher-Suites/ta-p/55543

Could anyone provide some advice for this situation?

Cheers

Re: Cipher suites decryption 7.1

reaper — Wed, 01 Jun 2016 09:48:13 GMT

Hi Jack

there are some limitations for ECDHE, did you take these into account:

For ECDHE, only named curves.
For ECDHE EC_point format, only uncompressed.

and that your cipher matches one of the listed modes (some ECDHEmodes are not supported)

Re: Cipher suites decryption 7.1

Jack_Howells — Wed, 01 Jun 2016 10:54:38 GMT

Hi,

Thanks for your response.

The cipher suites I'm using on the F5 load balancer are:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-CBC-SHA:ECDHE-RSA-AES128-CBC-SHA

Does this match the limitations for ECDHE?

Kind regards

Jack

Re: Cipher suites decryption 7.1

reaper — Wed, 01 Jun 2016 11:18:06 GMT

Hi Jack

Those appear to match... you could try setting up a packet-diag with log features 'flow basic' and 'proxy all' for 1 single source, this may help shine some light on why it isn't working as expected

check out this article for some help with the packet-diag: Getting Started: Flow Basic

Re: Cipher suites decryption 7.1

Jack_Howells — Wed, 01 Jun 2016 15:05:57 GMT

Thanks for your help!

Turns out in the small print the EDHC ciphers are only supported in SSL forward proxy decryption, not inbound, which is why they don't work with the current setup. So, although Palo state that certain ciphers are now supported in 7.1, it's best not to just go by the new cipher suites added in 7.1.

It's in very small print in the Decryption Profile under Protocol Settings:

Anyway, thank you again for your help.

Thanks

Jack