Change the SSL/TLS server configuration to only allow strong key exchanges. Key exchanges should provide at least 112 bits of security, which translat

[bhupendrakumar1]

Ho w to disable Weak SSL/TLS Key Exchange on Palo Alto Firewall while connecting  with Globa lProtect VPN 

[Adrian_Jensen]

Each of your GlobalProtect Portals and Gateways should have a SSL/TLS Service Profile under the Authentication tab. Go to Device->Certificate Management -> SSL/TLS Service Profiles and change the associated profile to Protocol Settings: Min Version = TLSv1.2

You can not specific specific key exchanges to be used as far as I am aware, just select the minimum/maximum SSL/TLS security level.