Disable Cipher Suite

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Disable Cipher Suite

L4 Transporter

As of the pen test via SSL LAB  i was observed that less secure ciphers like DES, RC4 were supported by global protect portal ,so that i have disable the all the weak cipher suite and it's successfully done but the when i disable CBC-256 Suite when i commit it got this error  Please Suggest 

 

Joshan_Lakhani_0-1596646238785.png

 

 

protocol-settings {

  min-version tls1-2;

  max-version max;

  enc-algo-aes-128-cbc no;

  enc-algo-aes-128-gcm no;

  auth-algo-sha256 no;

  auth-algo-sha384 no;

  enc-algo-aes-256-cbc no;

4 REPLIES 4

L4 Transporter

@Joshan_Lakhani Curious how do you block ciphers. I have the certificate imported and then creates SSL/TLS service profile set to minimum 1.2. Where do e select ciphers.

Ok.. I didn't know it as an option starting version 8.

I ran this command on our panorama(9.0.9) and only thing i see failing in ssllabs test is renegotiation. 

 

set template PA1 config vsys vsys1 ssl-tls-service-profile GP certificate VPN protocol-settings min-version tls1-2 enc-algo-aes-128-cbc no enc-algo-3des no enc-algo-aes-256-cbc no auth-algo-sha1 no enc-algo-rc4 no max-version max keyxchg-algo-rsa no

@raji_toor 

 

Please follow this KB  to disable weak cipher suite. As these cipher suite can be disable from 8.1 onward version before 8.1 you can not disable weak cipher suite.

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC

As I disable all other weak  cipher suite but the when i disable CBC-256 i got the error. As i use TLS1.2  3rd party certificate.Please suggest

  • 5900 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!