VA issue

cancel
Showing results for 
Search instead for 
Did you mean: 

VA issue

L0 Member

Is there anyway to solve those VA issue?

 

1) 90317 - SSH Weak Algorithms Supported

2) 42873 - SSL Medium Strength Cipher Suites Supported (SWEET32)

3) 70658 - SSH Server CBC Mode Ciphers Enabled

4) 71049 - SSH Weak MAC Algorithms Enabled

 

Kindly help please..Thank you

1 REPLY 1

L7 Applicator

For SSH

 

> configure
# delete deviceconfig system ssh
# set deviceconfig system ssh ciphers mgmt aes256-ctr
# set deviceconfig system ssh default-hostkey mgmt key-type ECDSA 256
# set deviceconfig system ssh regenerate-hostkeys mgmt key-type ECDSA key-length 256
# set deviceconfig system ssh session-rekey mgmt interval 3600
# set deviceconfig system ssh mac mgmt hmac-sha2-256
# commit
# exit
> set ssh service-restart mgmt

 

If you need to move away from using the diffie-hellman key exchange algorithm, you need to upgrade to PAN-OS 9.0 or above.
After upgrading, to modify the key-exchange algorithm for SSH please execute:

 

> configure
# set deviceconfig system ssh kex mgmt ecdh-sha2-nistp256
# commit
# exit
> set ssh service-restart mgmt

 

Please note that stronger versions are also available, so you can pick the one that you prefer, additional options include ecdh-sha2-nistp384 or ecdh-sha2-nistp521.

The command for those would instead be:

 

# set deviceconfig system ssh kex mgmt ecdh-sha2-nistp384
# set deviceconfig system ssh kex mgmt ecdh-sha2-nistp521

 

Special note for SSH:

If you are in HA, make sure you have an open SSH session to the secondary firewall prior to running those commands on a primary member in a cluster, because once you commit, and the config gets synced to the secondary, it won't let you SSH in until the SSH service is restarted. If you do forget, a simple way around it is to enable Telnet through GUI, jump in via Telnet, run the restart command and then disable Telnet again. Otherwise you have to get console access.

For SSL/TLS:

 

set shared ssl-tls-service-profile TLS-PROFILE protocol-settings min-version tls1-2
set shared ssl-tls-service-profile TLS-PROFILE protocol-settings max-version max
set shared ssl-tls-service-profile TLS-PROFILE protocol-settings auth-algo-sha1 no
set shared ssl-tls-service-profile TLS-PROFILE protocol-settings enc-algo-3des no
set shared ssl-tls-service-profile TLS-PROFILE protocol-settings enc-algo-rc4 no
set shared ssl-tls-service-profile TLS-PROFILE protocol-settings keyxchg-algo-dhe no

 

 

Special note for SSL:

If you move to using a ECDSA self-signed certificate for management, make sure you deploy a chained certificate. If you instead used a standalone ECDSA CA certificate it won't work and you will lose access to the WebUI. If you want to be careful, enable the HTTP service temporarily until you verify that the HTTPS access is working properly.

 

You can verify which algorithms the firewall is running by using these NMAP commands:

 

SSH

 

nmap --script ssh2-enum-algos -sV -p 22 [TARGET_IP]

 

 

SSL

 

nmap --script ssl-enum-ciphers -p 443 [TARGET_IP]

 

 

Here are official KBs which cover this topic as well.

HOW TO FIX WEAK CIPHERS AND KEYS ON THE MANAGEMENT INTERFACE FOR SSH ACCESS 

Refresh SSH Keys and Configure Key Options for Management Interface Connection

INFORMATION ON SWEET32 FOR PALO ALTO NETWORKS CUSTOMERS 

HOW TO DISABLE MEDIUM STRENGTH SSL CIPHERS FOR SSL/TLS SERVICE PROFILE 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!