topic Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface in General Topics

Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

mrafi — Wed, 15 Oct 2014 17:24:32 GMT

Hi All,

I have a case where customer needs to disable SSL 3.0 on an interface and just use SSL 1.0 and 2.0 for both device management and GP. Is this possible? if so then how? Is there any other way apart from disabling the entire SSL feature on the interface? Kindly Advice

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

bat — Wed, 15 Oct 2014 17:29:27 GMT

mrafi

I have not tested this but you can try creating a custom vulnerability with ssl-rsp-version 3 and block it:

The above vulnerability will only be effective for traffic going through dataplane port so if you are accessing management directly (without going dataplane port) this will not help for disabling SSLv3 on management interface.

Will keep you posted if I get a chance to try this in lab

Hope it helps !

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

hshah — Wed, 15 Oct 2014 17:43:33 GMT

Hi Mrafi,

You can not disable SSLv3 by any command or configuration.

However, you may want to try custom vuln. signature mentioned above.

Regards,

Hardik Shah

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

bat — Wed, 15 Oct 2014 18:45:33 GMT

mrafi

Just tested this in my lab and it works

You have to specify the decimal value for SSL 3.0 hexadecimal code (0x0300) which is 768.

Hope it helps !

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

hshah — Wed, 15 Oct 2014 19:33:42 GMT

Hi Mrafi,

This will stop SSLv3 on Data port only, for that you will have to configure custom vuln profile in policy.

This will not help to stop SSLv3 on Management interface.

Regards,

Hardik Shah

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

hshah — Wed, 15 Oct 2014 20:17:05 GMT

Hi Mrafi,

Just FYI...

http://www.networkworld.com/article/2833937/security/security-experts-warn-of-poodle-attack-against-ssl-30.html

Regards,

Hardik Shah

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

jambulo — Thu, 16 Oct 2014 15:23:29 GMT

I created a custom signature like csharma suggested and I can confirm that it works.

Although, it does not seem to work if you are decrypting the SSL traffic via Palo Alto.

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

bat — Thu, 16 Oct 2014 17:03:46 GMT

Just to add guys content version 463 has been released which contains the SSLv3 poodle vulnerability signature.

Hope it helps !

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

Sai_Tumuluri — Fri, 31 Oct 2014 00:04:17 GMT

No you can not disable this, the version is negotiated by the end-host and server.

The Vulnerability signature which is provided will not be applied to traffic destined to firewall

For example: people from DMZ are tried to manage firewall on firewall's DMZ interface, the signature will not be enough to identify ssl3, because content inspection is not applied when traffic is destined to firewall and not passing through the firewall. The same will apply to GP. we would not be able to identify this when SSL connection terminates on untrust interface of firewall

The work around while we wait for engineering is to host the service on loopback. Because when the service is hosted on loopback (different zone). This will make packet pass though the CTD engine of firewall like regular traffic to detect vulnerability.

Regards

Sai

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

choff123 — Fri, 31 Oct 2014 16:03:38 GMT

wow, so PA cant disable sslv3 ... thats not good. I know the sig can protect but common,,,, we cant pick protocols/ciphers on an enterprise class firewall ..?? AND its based on Linux right? so PA went out of its way to make it so we cant do this?

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

jambulo — Tue, 04 Nov 2014 14:44:06 GMT

Why does the PA NOT detect SSLv3 when it's set to decrypt the passing traffic?

Here's what I did to test...

1. I forced my browser to user ONLY SSLv3.

2. Set Threat ID 36815(SSLv3 Found in Server Response) to "drop-all-packets".

3. Browsed to web server behind the PA and page loaded fine.

4. Wireshark capture shows only SSLv3 being used.

5. Not detected in PA.

Then I tried web traffic that is not being decrypted and the PA detected and blocked the SSLv3 attempt.

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

ruby — Wed, 19 Nov 2014 10:13:09 GMT

I's suppose the PA to be able to adjust the SSL/TLS Versions allowed in SSL hello messages when performing SSL Decryption since it is acting as the clientside towards the WebServer ?!

Why is there no way to infuence this with a Decryption Profile?