QuickTip: Changes in iOS 11 or Mac OS X 10.13 affecting GlobalProtect connections

[jdelio]

Greetings Users, 

As times change, so do versions of iOS and macOS.  With this latest round of changes from Apple, are a few security changes that can cause some headaches if you are planning on using either iOS 11 or macOS X 10.13 to connect with GlobalProtect.

I wanted to point out some of the items that are listed to change:

• Removes support for TLS connections using SHA-1 certificates. Administrators of TLS services should update their services to use SHA-2 certificates. 
• Removes trust from certificates that use RSA key sizes smaller than 2048 bits across all TLS connections.
• Uses TLS 1.2 as the default for EAP-TLS negotiation. You can change this default setting with a configuration profile. Older clients might still need 1.0. 
• Authentication based on client certificates requires the server to support TLS 1.2 with cipher suites that are compatible with forward secrecy.

To read the entire article and get all the technical info about this, please see:

Mac OS X 10.13 and iOS 11 have new minimum requirements to establish GlobalProtect connections

Thanks for reading!

As always, we welcome all feedback and comments below. 

Stay secure,

Joe Delio

End of line.