Disable Weak cipher suite

[Joshan_Lakhani]

Has anyone had success getting past a B on ssllabs for the globalprotect web portal

# TLS 1.2 (suites in server-preferred order)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)   ECDH secp256r1 (eq. 3072 bits RSA)   FS   WEAK	256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)   DH 2048 bits   FS   WEAK

When i disable Weak cipher  suite i got this error please suggest

[MP18]

@Joshan_Lakhani 

Seems your SSL/TLS profile  uses a cert and that cert might be using these ciphers when you disable weak ciphers.

I tested this on my PA and did the commit and no issues.

Please check Ciphers used the certificate for SSL/TLS profile.

Regards

[Joshan_Lakhani]

@MP18 

As i  have  disable the all the other weak cipher only one cipher suite cbc-256 is when i disable this error is Kindly suggest

[OwenFuller]

You can disable the weak ciphers w/ CLI commands.  This Reddit thread has a good walk-through.  When I followed it, I got up to an A- on the SSLLabs evaluation.

https://www.reddit.com/r/paloaltonetworks/comments/hexquf/global_protect_and_cipher_suites/

[MannCave]

Run the following commands on in the cli at the edit prompt.

then commit

set shared ssl-tls-service-profile ?  (to get the security profile name)

set shared ssl-tls-service-profile (select your security profile here) protocol-settings keyxchg-algo-rsa no
set shared ssl-tls-service-profile (select your security profile here) protocol-settings enc-algo-rc4 no
set shared ssl-tls-service-profile (select your security profile here) protocol-settings enc-algo-aes-256-cbc no
set shared ssl-tls-service-profile (select your security profile here) protocol-settings enc-algo-3des no
set shared ssl-tls-service-profile (select your security profile here) protocol-settings auth-algo-sha1 no