This link (https://www.ietf.org/mail-archive/web/tls/current/msg27066.html) says that PAN-OS 8.1.4, PAN-OS 8.0.14, and PAN-OS 7.1.21 will fix a TLS issue. I don't see any mention of this in the 8.1.4 addressed issues page though. Do we know this is fixed for sure?
Solved! Go to Solution.
While I dont know for sure, there was another thread post where someone stated that upgrading to 8.1.4 fixed their issue. You can always open a TAC case to get them to verify.
Through testing 8.1.4 has proven to address the TLS 1.3 downgrade issues that folks were seeing with Chrome 70 installed. You won't see it listed as an addressed issue; from discussions with those internal to PA it doesn't appear that they are really counting it as an "issue" per say.
With the release of chrome version 72, if I use an SSL forward proxy that does not support TLS 1.3 will my connection still negotiate down to TLS 1.2 between Gmail and my Chrome client without upgrading to one of these releases (7.1.21, 8.0.14 and 8.1.4) ?
We received an "Important Customer Update" email from Palo which referenced the TLS 1.3 issue, but provided no link for additional information.
My current understanding is the Chrome v72 will re-enable the tls 1.3 downgrade protections that were removed shortly after v70 (it wasn't supposed to be active in 70) was shipped. This means that prior to downloading v72 you will want to be running 7.1.21, 8.0.14, or 8.1.4 or later if using SSL decryption to avoid the TLS downgrade messages.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!