8.1.4 & TLS 1.3?

Reply
L3 Networker

8.1.4 & TLS 1.3?

This link (https://www.ietf.org/mail-archive/web/tls/current/msg27066.html) says that PAN-OS 8.1.4, PAN-OS 8.0.14, and PAN-OS 7.1.21 will fix a TLS issue.  I don't see any mention of this in the 8.1.4 addressed issues page though.  Do we know this is fixed for sure?

L7 Applicator

Re: 8.1.4 & TLS 1.3?

Hello,

While I dont know for sure, there was another thread post where someone stated that upgrading to 8.1.4 fixed their issue. You can always open a TAC case to get them to verify.

 

Regards,

L7 Applicator

Re: 8.1.4 & TLS 1.3?

@OGMaverick,

Through testing 8.1.4 has proven to address the TLS 1.3 downgrade issues that folks were seeing with Chrome 70 installed. You won't see it listed as an addressed issue; from discussions with those internal to PA it doesn't appear that they are really counting it as an "issue" per say. 

 

L0 Member

Re: 8.1.4 & TLS 1.3?

With the release of chrome version 72, if I use an SSL forward proxy that does not support TLS 1.3 will my connection still negotiate down to TLS 1.2 between Gmail and my Chrome client without upgrading to one of these releases (7.1.21, 8.0.14 and 8.1.4) ?

 

We received an "Important Customer Update" email from Palo which referenced the TLS 1.3 issue, but provided no link for additional information.

L7 Applicator

Re: 8.1.4 & TLS 1.3?

@Michael_SD,

My current understanding is the Chrome v72 will re-enable the tls 1.3 downgrade protections that were removed shortly after v70 (it wasn't supposed to be active in 70) was shipped. This means that prior to downloading v72 you will want to be running 7.1.21, 8.0.14, or 8.1.4 or later if using SSL decryption to avoid the TLS downgrade messages. 

L0 Member

Re: 8.1.4 & TLS 1.3?

Thank you for clarifying that.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!