Diasble 7.1 Administrative session cipher suites

[RyanJohnstone]

Hello,

A recent PEN Test has advised we disbale the Arcfour when connecting via SSH to manage the Palo Alto via CLI. 

We are on release 7.1.6 (pending upgrade).

https://www.paloaltonetworks.com/documentation/global/compatibility-matrix/supported-cipher-suites/c...

can you advise please on how we disable these ciphers or if they are removed when upgrading to later code which we are due to do in near future.

Many thanks

Rayn

[Remo · Accepted solution]

Hi @RyanJohnstone

You cannot disable single algorithms, in PAN-OS 7.1 ... but starting ith PAN-OS 8.0 it will be possible.

configure
set deviceconfig system ssh ciphers mgmt aes128-cbc
set deviceconfig system ssh ciphers mgmt aes192-cbc
set deviceconfig system ssh ciphers mgmt aes256-cbc
set deviceconfig system ssh ciphers mgmt aes128-ctr
set deviceconfig system ssh ciphers mgmt aes192-ctr
set deviceconfig system ssh ciphers mgmt aes256-ctr
set deviceconfig system ssh ciphers mgmt aes128-gcm
set deviceconfig system ssh ciphers mgmt aes256-gcm

[RyanJohnstone]

Thanks for response, we are looking to move up to 8.1 so will use below then.

many thanks again

Ryan