Comment désactiver les SSL chiffrements de force moyenne pour SSL / Profil TLS de service
161073
Created On 02/14/19 23:10 PM - Last Modified 03/31/23 18:40 PM
Objective
- Désactiver les SSL chiffrements moyens comme 3DES
Environment
- PAN-OS 8,1 ou plus
- Réseau testé par Security Scan (Nessus)
- Page portail Global Protect
Procedure
À partir de CLI la, vous pouvez désactiver SSL les chiffrements d’un déjà configuré " SSL / Profil de service " en exécutant la commande TLS ci-dessous en mode configurer.
# définir les paramètres de protocole ssl-tls-service-profil <Name> partagés <tab>
Exemple.</tab> </Name>
admin@192.168.1.1> configure Entering configuration mode [edit] admin@192.168.1.1# set shared ssl-tls-service-profile (tab to view available "SSL/TLS Service Profiles") TLSprofileTest TLSprofileTest <value> Profile name admin@192.168.1.1# set shared ssl-tls-service-profile TLSprofileTest protocol-settings (tab to view options) + auth-algo-sha1 Allow authentication SHA1 + auth-algo-sha256 Allow authentication SHA256 + auth-algo-sha384 Allow authentication SHA384 + enc-algo-3des Allow algorithm 3DES + enc-algo-aes-128-cbc Allow algorithm AES-128-CBC + enc-algo-aes-128-gcm Allow algorithm AES-128-GCM + enc-algo-aes-256-cbc Allow algorithm AES-256-CBC + enc-algo-aes-256-gcm Allow algorithm AES-256-GCM + enc-algo-rc4 Allow algorithm RC4 + keyxchg-algo-dhe Allow algorithm DHE + keyxchg-algo-ecdhe Allow algorithm ECDHE + keyxchg-algo-rsa Allow algorithm RSA + max-version max-version + min-version min-version <Enter> Finish input admin@192.168.1.1# set shared ssl-tls-service-profile TLSprofileTest protocol-settings enc-algo-3des (tab to view options) no no yes yes admin@192.168.1.1# set shared ssl-tls-service-profile TLSprofileTest protocol-settings enc-algo-3des no [edit] admin@192.168.1.1#