Sweet32,3DES, SHA1,RC4, disable, using "RSA certificate" with SSL/TLS profile

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Sweet32,3DES, SHA1,RC4, disable, using "RSA certificate" with SSL/TLS profile

L4 Transporter

Sweet32,3DES, SHA1,RC4, disable, using "RSA certificate" with SSL/TLS profile

 

Hello good evening, as always thank you very much for your support, please help me to clarify an issue related to weak encryption of TLS/SSL Web-gui using rsa certificate to disable 3DES, SHA1 and RC4, of an SSL/TLS profile for WEB-GUI access and continue negotiating only with strong algorithms.

 

This is the reference link:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC 

 

With the following commands 3DES,SHA1 and RC4 are disabled:

That is explicit commands that disable 3des,sha1 and RC4 ( TLSprofileTest is an example of SSL/TLS profile):

set shared ssl-tls-service-profile TLSprofileTest protocol-settings enc-algo-3des no

set shared ssl-tls-service-profile TLSprofileTest protocol-settings auth-algo-sha1 no

set ssl-tls-service-profile TLSprofileTestprotocol-settings enc-algo-rc4 no

 

Now the question is the following, please answer as precisely as possible:

-When disabling the weak encryption and authentication algorithms with the "NO" option (previously detailed commands), is it necessary, should or is it required to explicitly set the strong algorithms as "YES"? or the firewall assumes, that by setting "NO" to the weak ones, the firewall will automatically negotiate with all other algorithms, except the ones that were declared as "NO" ( 3DES,SHA1 AND RC4 ).

 

I remain attentive, cordial greetings and attentive to your comments.

High Sticker
1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

Hello,

You do not need to set the others to yes, they are all enabled and you are just disabling the weak ones.

 

Hope this helps.

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

Hello,

You do not need to set the others to yes, they are all enabled and you are just disabling the weak ones.

 

Hope this helps.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!