topic Re: Display SSL/TLS version in traffic logs (app coloum), instead of just (ssl)? in General Topics

Display SSL/TLS version in traffic logs (app coloum), instead of just (ssl)?

CyberEdge — Mon, 29 Jul 2019 09:07:46 GMT

is there a way to display SSL/TLS version in traffic logs (app coloum), instead of just (ssl)? i have worked on another firewall vendors it's too easy to deteremin SSL/TLS version for troubleshooting instead of packet capture for many many customers because we enforced TLS1.2 on all web/ftp servers

Thank you

Mohanad

Re: Display SSL/TLS version in traffic logs (app coloum), instead of just (ssl)?

Brandon_Wertz — Mon, 29 Jul 2019 13:54:31 GMT

@CyberEdge wrote:
Hi

is there a way to display SSL/TLS version in traffic logs (app coloum), instead of just (ssl)? i have worked on another firewall vendors it's too easy to deteremin SSL/TLS version for troubleshooting instead of packet capture for many many customers because we enforced TLS1.2 on all web/ftp servers

Thank you
Mohanad

As of 9.0 and below looks like that's not an option. Maybe look into requesting a feature request for this? (My guess and more like a hope is this will be an option in 9.1)

Re: Display SSL/TLS version in traffic logs (app coloum), instead of just (ssl)?

Brandon_Wertz — Mon, 29 Jul 2019 14:09:53 GMT

Looks like there's already a FR for this. Might wanna add your name/company to the FR.

https://live.paloaltonetworks.com/t5/General-Topics/Feature-Request-List/td-p/209128/page/5

"4. Log /report / make a column header the TLS/SSL version detected on HTTPS sites. - FR5678"