This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About CLIq
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About CLIq
33Posts
4Likes
1Solution
Last Visited
User
Activity
User
Profile
Latest posts by CLIq
| Subject | Views | Posted |
|---|---|---|
| 1093 | 04-13-2022 07:56 AM | |
| 3233 | 02-17-2022 02:38 AM | |
| 899 | 02-17-2022 02:17 AM | |
| 3114 | 05-24-2021 01:02 PM | |
| 4750 | 12-15-2020 01:48 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 02-17-2022 02:38 AM | |
| 1 Like | 12-18-2019 09:11 AM | |
| 1 Like | 02-06-2020 09:41 AM | |
| 1 Like | 01-27-2020 03:42 AM |
User Badges
Community Statistics
| Member Since | 09-17-2019 05:25 AM |
| Date Last Visited | |
| Posts | 33 |
| Total Likes Received | 4 |
04-13-2022
07:56 AM
adding to that confusion... the hub is not the initiator! it just looks that way because the firewall does not recognize the incoming traffic, not seeing the outgoing traffic in the logs adds to that confusion anyhow, according to Palo, as everyone can write anything in these forums, it shouldn't be taken seriously if someone writes that palo said something is not supported... at least we were promised that this is a supported and working feature (at least working under lab conditions), as for the working part... still working with palo TAC on it who also referred me to this thread 🙂
... View more
02-17-2022
02:38 AM
1 Kudo
That wont fully work with TLSv1.2 and TLSv1.3 at the same time, I figured out how to do this a while back and gave an example config to TAC but here it is as reference for everyone... To support both TLSv1.2 and TLSv1.3 at the same time and use secure ciphers, I found the following to work the best: Apache: SSLOpenSSLConfCmd ECDHParameters brainpoolP256r1 SSLOpenSSLConfCmd Curves secp521r1:secp384r1:prime256v1 SSLOpenSSLConfCmd SignatureAlgorithms ECDSA+SHA512:ECDSA+SHA384:ECDSA+SHA256:RSA+SHA512:RSA+SHA384:RSA+SHA256:rsa_pss_rsae_sha512:rsa_pss_rsae_sha256 SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384" nginx: ssl_conf_command ECDHParameters brainpoolP256r1 ssl_conf_command Curves secp521r1:secp384r1:prime256v1 ssl_conf_command SignatureAlgorithms ECDSA+SHA512:ECDSA+SHA384:ECDSA+SHA256:RSA+SHA512:RSA+SHA384:RSA+SHA256:rsa_pss_rsae_sha512:rsa_pss_rsae_sha256 ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384 this needs a certain minimum version of openssl and apache/nginx 🙂 a bit cumbersome but oh well... it fulfills palos restrictions/requirements while still offering all compatible and secure ciphers and being compatible to modern browsers (I checked this for TLSv1.2 and TLSv1.3 only as those were the only secure ones). if anyone does the same in other flavors like lighttpd, haproxy or any other platform that might need customization, please be so kind and post an example here as well so others can adapt it into their configs 🙂
... View more
02-17-2022
02:17 AM
@Alex_Samadthe panos.sh is freely available on acme github with all other deploy scripts, you can copy it and modify it to your needs to use it outside of acme.
... View more
05-24-2021
01:02 PM
You will need to feature request that... For Apache and nginx this requires a specific configuration and order (actually x25519 does not seem to be needed for tls1.3 but rsa_pss signature algorithm is and that is also not supported for tls1.2) to work... but it does work! So if you do feature request this with your SE, make sure you also request support for rsa_pss signature algorithm 🙂
... View more
12-15-2020
01:48 AM
sorry for digging out this years old threat but I have been trying to find some more detailled information on this but it seems some in depth insight of how this works is difficult to find... Of course shortly after posting this I found the technical answer: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/policy-based-forwarding/pbf/egress-path-and-symmetric-return.html So for anyone who is/was wondering how its actually done, its explained there... answered all my open questions 🙂
... View more
- Tags:
- pbf
Contact Me
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks