How to disable medium strength SSL ciphers for SSL/TLS Service Profile

How to disable medium strength SSL ciphers for SSL/TLS Service Profile

37719
Created On 02/14/19 23:10 PM - Last Updated 07/15/20 23:14 PM


Objective
  • To disable medium SSL ciphers like 3DES


Environment
  • PAN-OS 8.1 or higher
  • Network being tested by Security Scan (Nessus)
  • Global Protect Portal Page


Procedure
From the CLI you can disable SSL ciphers from an already configured "SSL/TLS Service Profile" by running the command below in configure mode. 

# set shared ssl-tls-service-profile <Name> protocol-settings <tab>

Example.
admin@192.168.1.1> configure
Entering configuration mode
[edit]

admin@192.168.1.1# set shared ssl-tls-service-profile    (tab to view available "SSL/TLS Service Profiles")
  TLSprofileTest   TLSprofileTest
  <value>          Profile name

admin@192.168.1.1# set shared ssl-tls-service-profile TLSprofileTest protocol-settings       (tab to view options)
+ auth-algo-sha1         Allow authentication SHA1
+ auth-algo-sha256       Allow authentication SHA256
+ auth-algo-sha384       Allow authentication SHA384
+ enc-algo-3des          Allow algorithm 3DES
+ enc-algo-aes-128-cbc   Allow algorithm AES-128-CBC
+ enc-algo-aes-128-gcm   Allow algorithm AES-128-GCM
+ enc-algo-aes-256-cbc   Allow algorithm AES-256-CBC
+ enc-algo-aes-256-gcm   Allow algorithm AES-256-GCM
+ enc-algo-rc4           Allow algorithm RC4
+ keyxchg-algo-dhe       Allow algorithm DHE
+ keyxchg-algo-ecdhe     Allow algorithm ECDHE
+ keyxchg-algo-rsa       Allow algorithm RSA
+ max-version            max-version
+ min-version            min-version
  <Enter>                Finish input

admin@192.168.1.1# set shared ssl-tls-service-profile TLSprofileTest protocol-settings enc-algo-3des     (tab to view options)
  no    no
  yes   yes

admin@192.168.1.1# set shared ssl-tls-service-profile TLSprofileTest protocol-settings enc-algo-3des no

[edit]
admin@192.168.1.1#

 


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments