so TLS 1.3 got IETF branded

[ADK999]

hey there,

since tls 1.3 is now a ietf standard, is there any use running ssl-decryption in the close future?

as far i understand 1.3 documents, it "looks like" 1.2 for the firewall, so there's no way to just block 1.3 and force both parties to downgrade to 1.2, or i'm wrong?

any news/tech docs from pan about the 1.3 "issue"?

so long

o/

[vsys_remo]

This will be interesting ... I am waiting already quite a while for an answer ...

Not sure where I read that, but the only chance seems to be an explicit proxy or the complete visibiluty for encrypted traffic is gone.

TLS1.3 in combination with DoH and also the DNS sinkhole feature is gone...

[BPry]

@ADK999,

You'll need to block TLS 1.3 on the client itself to force it to attempt to failback; but you're 100% right, the standard really isn't able to be decrypted as far as I'm aware. 

The standard will be interesting, as it essentially makes any sort of decrytion from the firewall as we know it impracticle. I wouldn't be suprised to see a move back to full fleged proxy servers or agent based firewalls directly on a end-users computer. I think at this point though we're still waiting on a good solution. 

[jsalmans]

I haven't read up on this but I'm assuming Inbound Decryption could eventually work if they implemented TLS 1.3 on PAN-OS?

Since you generally own the cert and servers with Inbound then you could always make them use TLS 1.2 but if your server team wanted to implement 1.3 wouldn't the firewall still be able to decrypt with the cert installed?

[vsys_remo]

Yes, inbound decryption will work - as soon as PAN-OS supports TLS1.3.

Until then - as the firewall does not know about TLS 1.3 - it only offers TLS1.2 to the clients as highest version. If the server in this case obly support TLS1.3, the inbound decryption will fail.