Detect RC4 traffic

[PMorendage]

How do we detect RC4 traffic without decrypting using the Palo Alto toolset (NGFW, SCM, SLS, IoT, etc.)?

In SLS, I can currently filter down to:

Application Subcategory = 'auth-service' AND Application = 'active-directory-base'

However, there is no option to identify the use of weak ciphers (e.g., RC4).

[TomYoung]

Hi @PMorendage ,

You can identify weak ciphers with a decryption profile for non-decrypted traffic.  Create a decryption rule with the action of no-decrypt and assign the decryption profile to it.  Since you do not want to block weak ciphers at this time, allow everything.

https://docs.paloaltonetworks.com/network-security/security-policy/administration/objects/decryption...

When a lot of traffic runs through the decryption profile, you can use cool tools to analyze the traffic.

https://docs.paloaltonetworks.com/network-security/decryption/administration/troubleshooting-decrypt...

After you have analyzed the traffic, you can choose to block weak certificates, ciphers, or protocols by unchecking the boxes in the decryption profile.

Thanks,

Tom

[PMorendage]

Thank you very much Tom , Let me test and get back to you