Global Protect Portal and weak cipher sets

[JeremyD]

Has anyone had success getting past a B on ssllabs for the globalprotect web portal.

i have created the below ssl profile and bound it to the global protect portal. even though enc-algo-aes-128-cbc and
enc-algo-aes-128-gcm are set to know, they still appear in the test

show shared ssl-tls-service-profile TestSSL
TestSSL {
protocol-settings {
min-version tls1-2;
max-version tls1-2;
auth-algo-sha1 no;
auth-algo-sha256 no;
auth-algo-sha384 yes;
enc-algo-3des no;
enc-algo-aes-128-cbc no;
enc-algo-aes-128-gcm no;
enc-algo-aes-256-cbc yes;
enc-algo-aes-256-gcm yes;
enc-algo-rc4 no;
keyxchg-algo-dhe yes;
keyxchg-algo-ecdhe yes;
keyxchg-algo-rsa no;
}
certificate "Wildcard 2020";
}

SSL Labs Report

# TLS 1.2 (suites in server-preferred order)

TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)   WEAK256TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)   WEAK128TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d)   WEAK256TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)   WEAK128TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)   WEAK128TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)   ECDH secp256r1 (eq. 3072 bits RSA)   FS   WEAK256TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)   ECDH secp256r1 (eq. 3072 bits RSA)   FS   WEAK128TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH secp256r1 (eq. 3072 bits RSA)   FS256TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH secp256r1 (eq. 3072 bits RSA)   FS128TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)   DH 2048 bits   FS   WEAK256TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)   DH 2048 bits   FS   WEAK128TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)   DH 2048 bits   FS256TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)   DH 2048 bits   FS128

[OwenFuller]

Yes, we have gotten ours up to A- by running the following commands on our firewalls in config mode (substitute your profile names as appropriate):

set shared ssl-tls-service-profile GlobalProtect protocol-settings auth-algo-sha1 no
set shared ssl-tls-service-profile GlobalProtect protocol-settings keyxchg-algo-rsa no

Source:    https://www.reddit.com/r/paloaltonetworks/comments/hexquf/global_protect_and_cipher_suites/

[raji_toor]

Thus might help. After configuring i got A- today.

@JeremyD This might help got my A- today.

https://live.paloaltonetworks.com/t5/general-topics/disable-cipher-suite/m-p/342268#M85802