How to disable ssl v3 on vpn web page?

[choff123]

scanned the PA webserver we use for our VPN portal with qualys ssl scanner. Got a grade of F. Suggested to disable ....

• Diffie-Hellman (DH) key exchange
• 512-bit export suites
• Ssl v2 and v3

how can I go about doing this?

[rrajendran]

Hi Choff,

According to me, there isn't any option for disabling DH key exchange and 512-bit suites. You can only avoid using them. However, if you have configured IPSEC VPN, you would have to use any one of the DH group while choosing your IKE proposals.

Also, there is no option to disable SSLV2 AND V3, but due to issues related to CVE-2015-0204, our firewall stopped supporting SSLV3 from 6.0.8 and 6.1.2.

Hope this is helpful.

Regards,

Ramya

[hshah]

Hi Choffr,

You can not disable any encryption algorithm on PANW firewall. You can either disable on client or server.

You can block it via custom application/signature, but its not going to help. Because client will keep on try to connect on those algorithms which will result in failure attempts.

Regards,

Hardik Shah

[Satish]

Hi Choffr,

I am agree with Hardik.

tnx

Satish