SSL/TLS Client-Initiated Renegotiation Vulnerability in NGFW LAN Int

[SubaMuthuram]

Hi, 

One of our runs vulnerability  Assessment on LAN Interface of the PA NGFW, And they are getting SSL/TLS Client-Initiated Renegotiation vulnerability, Please help me to remediate the same. 

[Adrian_Jensen · Accepted solution]

You don't give much detail... but this is probably a renegotiation to lower TLS versions 1.0/1.1 that are vulnerable. Look at which SSL/TLS Profile you are using on your PA management interface:

Device -> Setup -> Management -> General Settings -> SSL/TLS Service Profile == <xxx>

Then make sure your SSL/TLS profile is set to minimum TLS 1.2 (Note: Some older apps/browsers may not be able to handle this, so check if you are using the SSL/TLS profile for something else as well). Update the SSL/TLS profile:

Device -> Certificate Management -> SSL/TLS Service Profile -> <xxx> -> Min Version = 1.2

[SubaMuthuram]

Thanks @Adrian_Jensen , 

I have resolved with the same way. 

[PatrickMurphy]

Hmmm.. My scans still show this as an issue after applying these settings.

[Adrian_Jensen]

Do you have multiple certificate SSL/TLS profiles and you are alerting on one other than associated with the management port? I.e. a different profile for your GlobalProtect Portals and Gateways which are not a minimum of TLS>=1.2?