Secure Renegotiation in PANOS 9x?

Reply
Highlighted
L0 Member

Secure Renegotiation in PANOS 9x?

I'm seeing some posts stating that Secure Renegotiation is not supported on the Palo Alto platform. Is this still true for the latest release, v9.x? If so, how is it enabled? 

Tags (2)

Accepted Solutions
Highlighted
Cyber Elite

Hi @richardhicks 

 

At least on a global protect portal website secure renegotiation is still not supported ... so I assume this also applies to inbound decryption.

 

@BPry 

What do you think when TLS1.3 support will be added? I would saysomewhere in 2021 :P (with PAN-OS 10?)

View solution in original post


All Replies
Highlighted
Cyber Elite

@richardhicks,

I'm fairly certain that TLS Renegotiation was fixed in an update to 6.0, so it's been available for a while. Regardless renegotiation is dying anyways; TLS 1.3 removes it completely. 

Highlighted
L0 Member

Good to hear. So how to enable it? I'm certainly glad that TLS 1.3 eliminates it, but my customer has TLS 1.2 at the moment and need to elminate this audit finding. :)

Highlighted
Cyber Elite

Hi @richardhicks 

 

At least on a global protect portal website secure renegotiation is still not supported ... so I assume this also applies to inbound decryption.

 

@BPry 

What do you think when TLS1.3 support will be added? I would saysomewhere in 2021 :P (with PAN-OS 10?)

View solution in original post

Highlighted
Cyber Elite

@vsys_remo,

Last I heard it was still being targeted for 9.1**, but it wouldn't suprise me at all of this got pushed back to 10*. There's some really interesting papers you can find that speak in detail about the additional issues with TLS 1.3 and attempting to intercept that communication in a passive format. 

 

 

*version names referenced are simply picked from historical release information.

**Inside Baseball (IE: Roadmap) discussions are strictly confidential and enforced through an NDA. The information presented in this post is non-official information and was not directly supplied by Palo Alto Networks or its employees. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!