Disable Cipher Suite

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L4 Transporter

Disable Cipher Suite

As of the pen test via SSL LAB  i was observed that less secure ciphers like DES, RC4 were supported by global protect portal ,so that i have disable the all the weak cipher suite and it's successfully done but the when i disable CBC-256 Suite when i commit it got this error  Please Suggest 

 

Joshan_Lakhani_0-1596646238785.png

 

 

protocol-settings {

  min-version tls1-2;

  max-version max;

  enc-algo-aes-128-cbc no;

  enc-algo-aes-128-gcm no;

  auth-algo-sha256 no;

  auth-algo-sha384 no;

  enc-algo-aes-256-cbc no;

Highlighted
L4 Transporter

@Joshan_Lakhani Curious how do you block ciphers. I have the certificate imported and then creates SSL/TLS service profile set to minimum 1.2. Where do e select ciphers.

Highlighted
L4 Transporter

Ok.. I didn't know it as an option starting version 8.

I ran this command on our panorama(9.0.9) and only thing i see failing in ssllabs test is renegotiation. 

 

set template PA1 config vsys vsys1 ssl-tls-service-profile GP certificate VPN protocol-settings min-version tls1-2 enc-algo-aes-128-cbc no enc-algo-3des no enc-algo-aes-256-cbc no auth-algo-sha1 no enc-algo-rc4 no max-version max keyxchg-algo-rsa no

Highlighted
L4 Transporter

@raji_toor 

 

Please follow this KB  to disable weak cipher suite. As these cipher suite can be disable from 8.1 onward version before 8.1 you can not disable weak cipher suite.

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC

Tags (1)
Highlighted
L4 Transporter

As I disable all other weak  cipher suite but the when i disable CBC-256 i got the error. As i use TLS1.2  3rd party certificate.Please suggest

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!