Security Advice on SSH & SSL/TLS week ciphers

[Vijaygvasan]

Hi Team,

I have few queries to be addressed.

We have changed the SSL/TLS version using CLI to TLS 1.2 but when we run the scan we can see TLS 1.1 is also running at the back-end. We need to check which SSL/TLS version is running using CLI of the Firewall.

What command needs to be used to check the current TLS version of the firewall? in CLI

Secondly:

We need to know which SSL/TLS cipher is recommended. From our security team point of view we need to disable the below mentioned ciphers (DH & RSA) algorithms. If we disable these two will there be any issue?

How to disable them? Steps and commands to disable through CLI?

Will the firewall work intended even after disabling DH and RSA?

What are the recommended SSL/TLS cipher for the firewall?

Thirdly:

We need to know what is the current SSH Cipher its taking for the SSH of the firewall how to find which one is currently being used.

Let me know on the above

Cheers!

[OtakarKlier]

Hello,

Check out these articles as they may have the solution you are looking for.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PN5bCAG

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBGLCA4

Regards,

[Vijaygvasan]

I need the recommended SSH ciphers and command to check which SSH cipher algorithm is being used.

[OtakarKlier]

Hello,

Its in this article.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PN5bCAG

Regards,