Audit Global protect server

Reply
Highlighted
L4 Transporter

Audit Global protect server

Hi,

 

We launched a sslab test for a GlobalProtect Portal website. Our note is B. We would like to improve these two things but we dont know what it can be done in PA config. These are:

 

There is no support for secure renegotiation.  MORE INFO »
This server does not support Forward Secrecy with the reference browsers. Grade capped to B.  MORE INFO »
 
What means "secure renegotiation"? how can solve this in PA?
what about Palo support froward secrecy? anything to do in Palo?
 
Highlighted
Cyber Elite

Hi @jesuscano 

Forward secrecy actually is supported by paloalto. If you look at the details of the browser handshake list, you should see most of them use ciphersuites with forward secrecy. Only a few - which count as reference browser for Qualys SSLLabs - do not use forward secrecy ciphersuites.

The point with the missing secure renegotiation is still true and unfortunately theres nothing you can do about that at the moment except wait until it is supportet (in PAN-OS 10 it is still not supported).

An explanation of secure renegotiation you can find here: https://devcentral.f5.com/s/articles/ssl-legacy-renegotiation-vs-secure-renegotiation-explained-usin...

Hi @jesuscano ,

 

You can easily get A minus on SSLlabs and take out most of the forward secrecy.

I assume you have your ssl-tls-service-profile set at minimum TLS 1.2

 

Just run the following via the CLI:

  • configure
  • set shared ssl-tls-service-profile yourprofile protocol-settings auth-algo-sha1 no
  • set shared ssl-tls-service-profile yourprofile protocol-settings enc-algo-3des no

 

While you are at it also disable the following:

  • set shared ssl-tls-service-profile yourprofile protocol-settings enc-algo-rc4 no
  • set shared ssl-tls-service-profile yourprofile protocol-settings keyxchg-algo-rsa no
  • commit

Unfortunately it does not fix anything for secure renegotiation.

 

Regards,

Raymond

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!