What SSL/TLS versions are allowed for WEBUI

[TSPphooper]

Hello,

I'm trying to verify which SSL/TLS versions and Ciphers the PANs accept for WEBUI connections.  Specifically I am trying to verify that it does not accept connections using weaker Protocols or Cipers and if it is configurable.

Please note that this is for Management connections to the PANs only, not user traffic.

Any help would be appreciated.

Thanks.

[HULK · Accepted solution]

Hello Sir,

To log into the firewall, the browser must be TLS 1.0 compatible.

Ciphers suits for Admin Sessions (web interface):

DHE-RSA-AES256-SHA

RSA-AES256-SHA

DHE-RSA-CAMELLIA256-SHA

RSA-CAMELLIA256-SHA

EDH-RSA-3DES-SHA

RSA-3DES-SHA (aka RSA-DES-CBC3-SHA aka DES-CBC3-SHA)

DHE-RSA-AES128-SHA

RSA-AES128-SHA

DHE-RSA-SEED-SHA

RSA-SEED-SHA

DHE-RSA-CAMELLIA128-SHA

CAMELLIA128-SHA

RSA-RC4-SHA

RSA-RC4-MD5

For data-plane traffic, The SSL versions supported by PAN-OS are: SSLv3, TLS1.0, and TLS1.1.

Hope it will help you.

Thanks

[TSPphooper]

Thank you very much for the Reply.

Is TLS 1.0 the only protocol that can be used for the Management Interface?  Older protocols such as SSLv2 will be denied and are not supported?  I suspect the answer is yes but need to verify.

[HULK]

Yes, you are correct.

[HULK]

Hello Sir,

I did a small test with IE to open WEBUI for PAN-FW management interface. It is working only with SSL 3.0 and TLS 1.0.

Thanks

[mikand]

According to the release notes for PANOS 6.0 most devices will now support TLS 1.2 for dataplane ssl/tls decryption.

[HULK]

Hello Mikand,

You are correct, The new PAN OS 6.0 is having capability to decrypt TLS 1.2. Although PANOS 5.0, if we detect a TLS1.1 or TLS1.2 session, we first try to downgrade it to TLS1.0 and decrypt. If that fails, we won't decrypt the session and either drop the session or allow it encrypted based upon your policy settings.

Thanks

[mbavishi]

Hello Hulk,

Is there a way to block sslv3 access to management interface of the firewall and allow only TLS1.0 ?

Thanks.

[hshah]

Hi Mbavishi,

Latest content has fix for vulnerability related sslv3, if management traffic is traversing through the Dataports than it can blocked.

If not, there is no way to block it.

Regards,

Hardik Shah

[hshah]

Hi Mbavishi,

Please refer following thread for more detail.

Re: Is it possible to Specifically Disable SSL 3.0 on a Palo Alto Interface

Regards,

Hardik Shah