8.1.4 & TLS 1.3?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

8.1.4 & TLS 1.3?

L3 Networker

This link (https://www.ietf.org/mail-archive/web/tls/current/msg27066.html) says that PAN-OS 8.1.4, PAN-OS 8.0.14, and PAN-OS 7.1.21 will fix a TLS issue.  I don't see any mention of this in the 8.1.4 addressed issues page though.  Do we know this is fixed for sure?

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

@OGMaverick,

Through testing 8.1.4 has proven to address the TLS 1.3 downgrade issues that folks were seeing with Chrome 70 installed. You won't see it listed as an addressed issue; from discussions with those internal to PA it doesn't appear that they are really counting it as an "issue" per say. 

 

View solution in original post

5 REPLIES 5

Cyber Elite
Cyber Elite

Hello,

While I dont know for sure, there was another thread post where someone stated that upgrading to 8.1.4 fixed their issue. You can always open a TAC case to get them to verify.

 

Regards,

Cyber Elite
Cyber Elite

@OGMaverick,

Through testing 8.1.4 has proven to address the TLS 1.3 downgrade issues that folks were seeing with Chrome 70 installed. You won't see it listed as an addressed issue; from discussions with those internal to PA it doesn't appear that they are really counting it as an "issue" per say. 

 

With the release of chrome version 72, if I use an SSL forward proxy that does not support TLS 1.3 will my connection still negotiate down to TLS 1.2 between Gmail and my Chrome client without upgrading to one of these releases (7.1.21, 8.0.14 and 8.1.4) ?

 

We received an "Important Customer Update" email from Palo which referenced the TLS 1.3 issue, but provided no link for additional information.

@Michael_SD,

My current understanding is the Chrome v72 will re-enable the tls 1.3 downgrade protections that were removed shortly after v70 (it wasn't supposed to be active in 70) was shipped. This means that prior to downloading v72 you will want to be running 7.1.21, 8.0.14, or 8.1.4 or later if using SSL decryption to avoid the TLS downgrade messages. 

Thank you for clarifying that.
  • 1 accepted solution
  • 4105 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!