8.1.4 & TLS 1.3?

[OGMaverick]

This link (https://www.ietf.org/mail-archive/web/tls/current/msg27066.html) says that PAN-OS 8.1.4, PAN-OS 8.0.14, and PAN-OS 7.1.21 will fix a TLS issue.  I don't see any mention of this in the 8.1.4 addressed issues page though.  Do we know this is fixed for sure?

[OtakarKlier]

Hello,

While I dont know for sure, there was another thread post where someone stated that upgrading to 8.1.4 fixed their issue. You can always open a TAC case to get them to verify.

Regards,

[BPry · Accepted solution]

@OGMaverick,

Through testing 8.1.4 has proven to address the TLS 1.3 downgrade issues that folks were seeing with Chrome 70 installed. You won't see it listed as an addressed issue; from discussions with those internal to PA it doesn't appear that they are really counting it as an "issue" per say. 

[Michael_SD]

With the release of chrome version 72, if I use an SSL forward proxy that does not support TLS 1.3 will my connection still negotiate down to TLS 1.2 between Gmail and my Chrome client without upgrading to one of these releases (7.1.21, 8.0.14 and 8.1.4) ?

We received an "Important Customer Update" email from Palo which referenced the TLS 1.3 issue, but provided no link for additional information.

[BPry]

@Michael_SD,

My current understanding is the Chrome v72 will re-enable the tls 1.3 downgrade protections that were removed shortly after v70 (it wasn't supposed to be active in 70) was shipped. This means that prior to downloading v72 you will want to be running 7.1.21, 8.0.14, or 8.1.4 or later if using SSL decryption to avoid the TLS downgrade messages. 

[Michael_SD]

Thank you for clarifying that.