How to apply the SSL/TLS profile to a management interface
22490
Created On 06/26/24 14:45 PM - Last Modified 07/09/25 19:50 PM
Objective
- To apply SSL/TLS profile to management interface.
- Once the SSL-TLS settings are changed (such as disable of weak ciphers), it needs to be applied to the the management interface.
Environment
- Palo Alto Firewalls or Panorama
- PAN-OS 9.1 and above
- SSL-TLS profile
Procedure
From CLI:
- Create SSL-TLS profile with the new ciphers. An example of 'fw-mgt-strong-ssl-profile' is created below by removing weak ciphers. The certificate "fw-mgt-rsa-cert" is already created.
admin@FW> configure
admin@FW# set shared ssl-tls-service-profile fw-mgt-strong-ssl-profile protocol-settings min-version tls1-2
admin@FW# set shared ssl-tls-service-profile fw-mgt-strong-ssl-profile protocol-settings max-version max
admin@FW# set shared ssl-tls-service-profile fw-mgt-strong-ssl-profile protocol-settings enc-algo-aes-256-cbc no
admin@FW# set shared ssl-tls-service-profile fw-mgt-strong-ssl-profile protocol-settings enc-algo-aes-128-cbc no
admin@FW# set shared ssl-tls-service-profile fw-mgt-strong-ssl-profile certificate fw-mgt-rsa-cert
- Apply the above ssl-tls-service-profile to the management interface using the following system command.
admin@FW# set deviceconfig system ssl-tls-service-profile fw-mgt-strong-ssl-profile
- Commit the configuration changes
admin@FW# commit force
admin@FW> exit
- To view the configuration, use the following command in config mode.
admin@FW# show shared ssl-tls-service-profile fw-mgt-strong-ssl-profile
- To update the SSL-TLS profile in management using GUI:
- Go to GUI: Device > Setup > Management > General Settings.
- Edit and update the "SSL/TLS Service Profile".
- Commit the changes.
NOTE:
After commit, new SSL/TLS profile will be applied to the WEB GUI and you may lose the WEB GUI connectivity and you need to re-login to match with the new SSL/TLS profile settings.
There WILL NO connectivity issue with the existing SSH sessions.
Additional Information
- How to disable medium strength SSL ciphers for SSL/TLS Service Profile on Firewall
- Replace the Certificate for Inbound Management Traffic
- To secure the SSH Access to the management interface of the Firewall/Panorama use the following Knowledgebase
Commands to fix weak ciphers and keys on the mgmt interface for SSH access in PAN-OS 10.0