filter ssh v1

[Cesar.pevezFajardo]

Hi

I have a request to filter in the firewall ssh v1. Is there any way to identify and filter ssh v1? can the firewall identify ssh v2 some way?

[gafrol]

Hi Cesar,

ssh is at least listed in the applipedia as a known App.

http://apps.paloaltonetworks.com/applipedia/

rgds Roland

[Cesar.pevezFajardo]

Thanks Roland

The problem I have is that I don't see any reference to the version of SSH in the app description. I will like to know if there is any mechanism to diferentiate v1 from v2, so I can permit only v1.

[gafrol]

It seems the APP does not differentiate between ssh1 and ssh2, just my guess....

Roland

[mikand]

You can setup a SSH decryption policy to handle ssh vs ssh-tunnel. But I dont think it currently supports stuff like v1 vs v2.

Look at page 143 in the PA-4.1_Administrators_Guide.pdf for more info.

I think you need to contact your sales rep. to file this as a feature request.

[emr_1]

I can see 'SSH2 Login Attempt' (ID:31914) under vulnerability protection signature.

If you permit ssh in security rule and block this signature  on the same rule,

can't you permit ssh v1 only?

Just my guess.

Regards,

Emr