Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About CLIq
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About CLIq
33Posts
4Likes
1Solution
Last Visited
User
Activity
User
Profile
Latest posts by CLIq
| Subject | Views | Posted |
|---|---|---|
| 227 | 04-13-2022 07:56 AM | |
| 1165 | 02-17-2022 02:38 AM | |
| 366 | 02-17-2022 02:17 AM | |
| 2163 | 05-24-2021 01:02 PM | |
| 2881 | 12-15-2020 01:48 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 02-17-2022 02:38 AM | |
| 1 Like | 12-18-2019 09:11 AM | |
| 1 Like | 02-06-2020 09:41 AM | |
| 1 Like | 01-27-2020 03:42 AM |
User Badges
Community Statistics
| Member Since | 09-17-2019 05:25 AM |
| Date Last Visited | |
| Posts | 33 |
| Total Likes Received | 4 |
04-13-2022
07:56 AM
adding to that confusion... the hub is not the initiator! it just looks that way because the firewall does not recognize the incoming traffic, not seeing the outgoing traffic in the logs adds to that confusion anyhow, according to Palo, as everyone can write anything in these forums, it shouldn't be taken seriously if someone writes that palo said something is not supported... at least we were promised that this is a supported and working feature (at least working under lab conditions), as for the working part... still working with palo TAC on it who also referred me to this thread 🙂
... View more
02-17-2022
02:38 AM
1 Kudo
That wont fully work with TLSv1.2 and TLSv1.3 at the same time, I figured out how to do this a while back and gave an example config to TAC but here it is as reference for everyone... To support both TLSv1.2 and TLSv1.3 at the same time and use secure ciphers, I found the following to work the best: Apache: SSLOpenSSLConfCmd ECDHParameters brainpoolP256r1 SSLOpenSSLConfCmd Curves secp521r1:secp384r1:prime256v1 SSLOpenSSLConfCmd SignatureAlgorithms ECDSA+SHA512:ECDSA+SHA384:ECDSA+SHA256:RSA+SHA512:RSA+SHA384:RSA+SHA256:rsa_pss_rsae_sha512:rsa_pss_rsae_sha256 SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384" nginx: ssl_conf_command ECDHParameters brainpoolP256r1 ssl_conf_command Curves secp521r1:secp384r1:prime256v1 ssl_conf_command SignatureAlgorithms ECDSA+SHA512:ECDSA+SHA384:ECDSA+SHA256:RSA+SHA512:RSA+SHA384:RSA+SHA256:rsa_pss_rsae_sha512:rsa_pss_rsae_sha256 ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384 this needs a certain minimum version of openssl and apache/nginx 🙂 a bit cumbersome but oh well... it fulfills palos restrictions/requirements while still offering all compatible and secure ciphers and being compatible to modern browsers (I checked this for TLSv1.2 and TLSv1.3 only as those were the only secure ones). if anyone does the same in other flavors like lighttpd, haproxy or any other platform that might need customization, please be so kind and post an example here as well so others can adapt it into their configs 🙂
... View more
02-17-2022
02:17 AM
@Alex_Samadthe panos.sh is freely available on acme github with all other deploy scripts, you can copy it and modify it to your needs to use it outside of acme.
... View more
05-24-2021
01:02 PM
You will need to feature request that... For Apache and nginx this requires a specific configuration and order (actually x25519 does not seem to be needed for tls1.3 but rsa_pss signature algorithm is and that is also not supported for tls1.2) to work... but it does work! So if you do feature request this with your SE, make sure you also request support for rsa_pss signature algorithm 🙂
... View more
12-15-2020
01:48 AM
sorry for digging out this years old threat but I have been trying to find some more detailled information on this but it seems some in depth insight of how this works is difficult to find... Of course shortly after posting this I found the technical answer: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/policy-based-forwarding/pbf/egress-path-and-symmetric-return.html So for anyone who is/was wondering how its actually done, its explained there... answered all my open questions 🙂
... View more
- Tags:
- pbf
11-15-2020
10:44 AM
@panguyen hope you read this at some point, the certificate the script imports to the firewall seems to not import the fullchain? at least clients are reporting errors about not trusting the certificate because of missing intermediate certificates / chain. now this doesnt pose issues under windows or even chrome or firefox but for some applications that check certificates as well or e.g. macosx this causes invalid certificate chain trust issues. am i doing something wrong or is the fullchain not imported?
... View more
10-16-2020
02:21 AM
from a wireshark capture, i can see that if for TLSv1.2 any other supported protocols are used, the palo sens a Server Hello with the first matching cipher and right after it sends a [RST, ACK] to the client which is originated only from the firewall, the server actually sends the certificate to the palo, so the issue seems to be between the palo and the client with PANOS 10.0.1 I should probably open a support case to look into this but I thought maybe someone has already looked into this 🙂
... View more
10-16-2020
01:13 AM
@panguyen great work on the write-up and script! does your script import the complete certificate chain? if not by default, is there a way to do so? 🙂 by the way, the script has an issue when importing wildcard certificates, has something to do with the naming. workaround is to create the certificate as e.g. mydomain.com and add a SAN for *.mydomain.com one suggestion to the how to, would be cool to include a way without cloudflare (e.g. apache) and for both modes also mention which firewall rules need to be configured in which direction at a minimum (e.g. I used a custom url category to match the well-known acme-challenge URL for incoming traffic but only allowed the actual domain to be accessed from certain countries before i now also switched to dns_cf api)
... View more
10-14-2020
09:53 AM
Hi, is there a way for globalprotect to only listen to a specific URL and forward all other FQDNs? I already have webservers behind the palo listening to specific SNIs and would like to keep it this way.
... View more
10-14-2020
07:41 AM
There is nothing in the sslmgr.log and nothing but the General errors in the UI the only ciphers that seem to work with Palo decryption on TLSv1.2 and Chrome/Firefox are these two: AES256-GCM-SHA384:AES128-GCM-SHA256 all others error out even if those ciphers above are also available but not listed first (SSLHonorCipherOrder is set to off) but with these ciphers which are considered weak, i dont even get forward secrecy and therefore the rating is down to B... I wonder why the following ciphers dont work: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHCHA20-POLY1305-SHA256:CHACHA20-POLY1305-SHA256 or the ECDHE-ECDSA ones which are listed as supported but not shown in the decryption profile settings anyone have an idea or even just an idea how to troubleshoot this further?
... View more
10-12-2020
01:28 PM
@Rene_Boehme or anyone know working ciphers for apache with TLSv1.2 and which ones work TLSv1.3?
... View more
10-10-2020
02:17 PM
running PANOS 10.0.1, log only shows "General TLS protocol error" together with the ciphers that were used any specific debug or log i should show?
... View more
10-10-2020
09:02 AM
I am trying to set up a TLSv1.3 / TLSv1.2 webserver behind a palo firewall with ssl inbound decryption. However i seem to get a lot of ssl errors and the website does not work if specific ciphers are not listed first... For one I would like to understand why that is and even ciphers listed here have issues: https://docs.paloaltonetworks.com/compatibility-matrix/supported-cipher-suites/cipher-suites-supported-in-pan-os-10-0/cipher-suites-supported-in-pan-os-10-0-decryption.html#id11638f8b-8bc0-4189-800d-43f1567339b6 Basically, what should the apache config look like for the palo to be able to decrypt the traffic, yet still have the highest possible security (e.g. as rated by https://www.ssllabs.com/ssltest/) ?
... View more
03-02-2020
08:21 AM
as a further response... seems the panorama has not been designed for such a use-case as without a valid license you cannot even enter most of the configuration... was hoping that the licensing could be taken care of manually after the "automatic config restore"
... View more
Contact Me
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks
