topic Re: Diasble 7.1 Administrative session cipher suites in General Topics

Diasble 7.1 Administrative session cipher suites

RyanJohnstone — Fri, 23 Nov 2018 09:44:07 GMT

Hello,

A recent PEN Test has advised we disbale the Arcfour when connecting via SSH to manage the Palo Alto via CLI.

We are on release 7.1.6 (pending upgrade).

https://www.paloaltonetworks.com/documentation/global/compatibility-matrix/supported-cipher-suites/cipher-suites-supported-in-pan-os-7-1/cipher-suites-supported-in-pan-os-7-1-admin-sessions#id1822C0W092G

can you advise please on how we disable these ciphers or if they are removed when upgrading to later code which we are due to do in near future.

Many thanks

Rayn

Re: Diasble 7.1 Administrative session cipher suites

Remo — Fri, 23 Nov 2018 18:00:39 GMT

Hi @RyanJohnstone

You cannot disable single algorithms, in PAN-OS 7.1 ... but starting ith PAN-OS 8.0 it will be possible.

configure
set deviceconfig system ssh ciphers mgmt aes128-cbc
set deviceconfig system ssh ciphers mgmt aes192-cbc
set deviceconfig system ssh ciphers mgmt aes256-cbc
set deviceconfig system ssh ciphers mgmt aes128-ctr
set deviceconfig system ssh ciphers mgmt aes192-ctr
set deviceconfig system ssh ciphers mgmt aes256-ctr
set deviceconfig system ssh ciphers mgmt aes128-gcm
set deviceconfig system ssh ciphers mgmt aes256-gcm

Re: Diasble 7.1 Administrative session cipher suites

RyanJohnstone — Tue, 27 Nov 2018 14:39:51 GMT

Thanks for response, we are looking to move up to 8.1 so will use below then.

many thanks again

Ryan