How to allow all the traffic from TLS V1.2 and above on firewall

[ChandrashekharD]

Hi friends,

we have a customer who wants to block TLS version 1.0 and 1.1 and to allow all the traffic from TLS V1.2 and above on firewall.

Is there any option on palo alto firewall.

Customer requirement is that they need to block it from the interface / port level.

customer is doing a scan using a third party app.

Can we have any way to mitigate this issue.

Thanks and Regards

Chandrashekhar.

[Raido_Rattameister]

If you decrypt outgoing traffic then you can create Decryption Profile (Objects > Decryption > Decryption Profile) where you can set minimum TLS version.

Then attach this profile to your decryption policy.