How to Block weak ciphers?

[raji_toor]

Can PA be used block weak ciphers at zone or server level?

[BPry]

@raji_toor

Take a look at SSL-Decryption profiles. 

https://live.paloaltonetworks.com/t5/tkb/articleprintpage/tkb-id/FeaturedArticles/article-id/120

[raji_toor]

@BPry What if decryption is not enabled or is not an option.

[BPry]

@raji_toor,

If you aren't utilizing Decryption then I believe your only option is going to be through a Vulnerability Protection profile and the only Threat that deals with weak ciphers is ID 38924 'SSL Version 2 Weak RSA Cipher Detected' which you could modify from the default of 'alert' and change it to reset if you'd like. 

[jvalentine]

@raji_toor This can also be done with custom signatures.  I created one recently for a customer who wanted to block connections using "sha1WithRSAEncryption"

<vulnerability-threat version="8.1.0">
  <entry name="41023">
    <signature>
      <standard>
        <entry name="sig1">
          <and-condition>
            <entry name="And Condition 1">
              <or-condition>
                <entry name="Or Condition 1">
                  <operator>
                    <pattern-match>
                      <pattern>\x2a864886f70d010105\x</pattern>
                      <context>ssl-rsp-certificate</context>
                      <negate>no</negate>
                    </pattern-match>
                  </operator>
                </entry>
              </or-condition>
            </entry>
          </and-condition>
          <order-free>yes</order-free>
          <scope>session</scope>
        </entry>
      </standard>
    </signature>
    <default-action>
      <alert/>
    </default-action>
    <threatname>sha1WithRSAEncryption</threatname>
    <severity>informational</severity>
    <direction>server2client</direction>
    <comment>detects the presence of SHA-1 signature algorithm ID of server during SSL handshake</comment>
    <affected-host>
      <client>yes</client>
    </affected-host>
  </entry>
</vulnerability-threat>

If you're interested in pursuing the custom signature option, head over to the Custom Signatures discussion area.