In Wildfire how do we disable weak TLS ciphers?

[pjohnson1]

Nessus scanning is picking up TCP/443 TLS v1.0 and v1.1 on our WildFire (WF-500) appliances.

Is there a way to turn off TLS v1.0 and v1.1 on the WildFire ?

Below is the Nessus scanner notification.

--------------------------------------------------------------------------------
Policy Violation 443/tcp Nessus ID: 56984
--------------------------------------------------------------------------------
Synopsis :
The remote service encrypts communications.

Description :
This plugin detects which SSL and TLS versions are supported by the
remote service for encrypting communications.

See also :



Solution :
n/a

Risk factor :
None / CVSS Base Score :0.0

Prioritized Risk :
None (VPR: n/a / CVSS v3: None / CVSS v2: None)

Plugin output :

This port supports TLSv1.0/TLSv1.1/TLSv1.2.

[nikoolayy1]

Hello,

Please see the article below and set the min TLS version you want:

https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/set-up-and-manage-a-wildfire-appliance...

---

• • PAN-OS 8.0 and later releases support TLS 1.2 and later TLS versions only. You must set the max version to TLS 1.2 or max.

    admin@WF-500#

    set shared ssl-tls-service-profile

    <name>protocol-settings min-version {tls1-0 | tls1-1 | tls1-2}

    admin@WF-500#

    set shared ssl-tls-service-profile

    <name>protocol-settings max-version {tls1-0 | tls1-1 | tls1-2 | max}
  • Configure secure server communication on the WildFire appliance.

    • Set the SSL/TLS profile. This SSL/TLS service profile applies to all SSL connection between WildFire and client devices.

      admin@WF-500#

      set deviceconfig setting management secure-conn-server ssl-tls-service-profile

      <ssltls-profile>