Cipher suites decryption 7.1

[Jack_Howells]

Hi guys,

Configuring inbound SSL inspection on 7.1, decryption does not work with the newly supported cipher suites shown in the document below.

https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-Supported-ciphers/ta-p/71969

Only the cipher suites shown in the document below again work. The document above states that ECDHE should work but it does not.   

https://live.paloaltonetworks.com/t5/Management-Articles/SSL-Decryption-Not-Working-due-to-Unsupport...

Could anyone provide some advice for this situation?

Cheers

[reaper]

Hi Jack

there are some limitations for ECDHE, did you take these into account:

   For ECDHE, only named curves.
   For ECDHE EC_point format, only uncompressed.

and that your cipher matches one of the listed modes (some ECDHEmodes are not supported)

[Jack_Howells]

Hi,

Thanks for your response.

The cipher suites I'm using on the F5 load balancer are:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-CBC-SHA:ECDHE-RSA-AES128-CBC-SHA

Does this match the limitations for ECDHE?

Kind regards

Jack

[reaper]

Hi Jack

Those appear to match... you could try setting up a packet-diag with log features 'flow basic' and 'proxy all' for 1 single source, this may help shine some light on why it isn't working as expected

check out this article for some help with the packet-diag: Getting Started: Flow Basic

[Jack_Howells]

Thanks for your help!

Turns out in the small print the EDHC ciphers are only supported in SSL forward proxy decryption, not inbound, which is why they don't work with the current setup. So, although Palo state that certain ciphers are now supported in 7.1, it's best not to just go by the new cipher suites added in 7.1.

It's in very small print in the Decryption Profile under Protocol Settings:

Anyway, thank you again for your help. 

Thanks

Jack