SSL and TLS vulnerabilities

[Senibo]

Hi Team,

We have to 2 Paloalto VM firewall running active-passive mode in AWS.

As a part of internal Pentest we go the below findings for the Active and passive firewall nodes. The result refers to SSL and TLS vulnerabilities.

Could you please suggest on how to mitigate this.

[Claw4609]

What is the specific vulnerability that is being flagged? My first thought is that you dont have a SSL/TLS Service profile attached to the managment interface or enforcing a minimum of tls 1.2.

Add a certificate to a SSL/TLS Service profile and enforcing tls v1.2: Configure an SSL/TLS Service Profile (paloaltonetworks.com)

Adding that SSL/TLS service profile to the management interface: Device > Setup > Management (paloaltonetworks.com)

[Senibo]

Hi, 

These are the Vuln that are being flagged  ==->  1. 38913 SSH Prefix Truncation Vulnerability (Terrapin)
2. 38909 SHA1 deprecated setting for SSH

[Claw4609]

Gotcha, then in that case I believe you are needed to create an SSH service profile and attach it. Depending on what you're all needing to be removed you may also need to follow the KB article attached.

Configure an SSH Service Profile (paloaltonetworks.com)

How to fix Weak Ciphers and Keys on the Management Interface fo... - Knowledge Base - Palo Alto Netw...