topic Re: Disable Weak cipher suite in General Topics

Disable Weak cipher suite

Joshan_Lakhani — Fri, 14 Aug 2020 16:54:50 GMT

Has anyone had success getting past a B on ssllabs for the globalprotect web portal

# TLS 1.2 (suites in server-preferred order)

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH secp256r1 (eq. 3072 bits RSA) FS WEAK

256

TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) DH 2048 bits FS WEAK

When i disable Weak cipher suite i got this error please suggest

Re: Disable Weak cipher suite

MP18 — Sun, 16 Aug 2020 19:05:39 GMT

@Joshan_Lakhani

Seems your SSL/TLS profile uses a cert and that cert might be using these ciphers when you disable weak ciphers.

I tested this on my PA and did the commit and no issues.

Please check Ciphers used the certificate for SSL/TLS profile.

Regards

Re: Disable Weak cipher suite

Joshan_Lakhani — Sun, 16 Aug 2020 19:27:05 GMT

@MP18

As i have disable the all the other weak cipher only one cipher suite cbc-256 is when i disable this error is Kindly suggest

Re: Disable Weak cipher suite

OwenFuller — Mon, 17 Aug 2020 15:24:34 GMT

You can disable the weak ciphers w/ CLI commands. This Reddit thread has a good walk-through. When I followed it, I got up to an A- on the SSLLabs evaluation.

https://www.reddit.com/r/paloaltonetworks/comments/hexquf/global_protect_and_cipher_suites/

Re: Disable Weak cipher suite

MannCave — Fri, 03 Sep 2021 16:23:26 GMT

Run the following commands on in the cli at the edit prompt.

then commit

set shared ssl-tls-service-profile ? (to get the security profile name)

set shared ssl-tls-service-profile (select your security profile here) protocol-settings keyxchg-algo-rsa no
set shared ssl-tls-service-profile (select your security profile here) protocol-settings enc-algo-rc4 no
set shared ssl-tls-service-profile (select your security profile here) protocol-settings enc-algo-aes-256-cbc no
set shared ssl-tls-service-profile (select your security profile here) protocol-settings enc-algo-3des no
set shared ssl-tls-service-profile (select your security profile here) protocol-settings auth-algo-sha1 no