Disabling weak ciphers for web GUI access is not working

Disabling weak ciphers for web GUI access is not working

18614
Created On 10/21/20 14:32 PM - Last Modified 02/27/21 03:23 AM


Symptom

Disabling weak ciphers for SSL/TLS service profiles does not disable the ciphers for Web GUI access.
This can be verified using the nmap tool to enumerate ssl-ciphers by using the command:

nmap --script ssl-enum-ciphers -p 443 <Firewall IP Address>

Example:
1. Before trying to disable weak ciphers:

admin@FW1# show shared ssl-tls-service-profile Cert_Profile protocol-settings 
set shared ssl-tls-service-profile Cert_Profile protocol-settings min-version tls1-2
set shared ssl-tls-service-profile Cert_Profile protocol-settings max-version max
[edit] 
Nmap Test Results:
nmap --script ssl-enum-ciphers -p 443 <IP of the FW>

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-29 12:05 CET
Nmap scan report for x.x.x.x
Host is up (0.011s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 0.50 seconds
2. Using the CLI commands to remove weak ciphers and committing the changes:
admin@FW1# configure
admin@FW1# show shared ssl-tls-service-profile Cert_Profile protocol-settings
set shared ssl-tls-service-profile Cert_Profile protocol-settings min-version tls1-2
set shared ssl-tls-service-profile Cert_Profile protocol-settings max-version max
set shared ssl-tls-service-profile Cert_Profile protocol-settings auth-algo-sha1 no
set shared ssl-tls-service-profile Cert_Profile protocol-settings auth-algo-sha256 no
set shared ssl-tls-service-profile Cert_Profile protocol-settings enc-algo-3des no
set shared ssl-tls-service-profile Cert_Profile protocol-settings enc-algo-aes-128-cbc no
set shared ssl-tls-service-profile Cert_Profile protocol-settings enc-algo-aes-128-gcm no
set shared ssl-tls-service-profile Cert_Profile protocol-settings enc-algo-rc4 no
set shared ssl-tls-service-profile Cert_Profile protocol-settings keyxchg-algo-dhe no
set shared ssl-tls-service-profile Cert_Profile protocol-settings keyxchg-algo-rsa no
admin@FW1# commit
[edit]

3. Nmap test results show no changes to the ciphers after the commit is done:

nmap --script ssl-enum-ciphers -p 443 <IP of the FW>

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-29 12:12 CET
Nmap scan report for x.x.x.x
Host is up (0.00034s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 0.46 seconds


Environment
  • Any Palo Alto Firewall.
  • Any Panorama.
  • PAN-OS version below 9.0.11 (9.0.x).
  • PAN-OS version below 9.1.5  (9.1.x).
  • PAN-OS version below 10.0.1 (10.0.x).


Cause

These commands only work for GlobalProtect Interfaces (Portal/Gateway) where SSL/TLS profiles are being used.



Resolution
Upgrade to PAN-OS version 9.0.11 (or 9.1.5 / 10.0.1) and above.
Starting from PAN-OS versions 10.0.1, 9.1.5, and 9.0.11, these commands will apply to the management interface as well.
This change has been documented in the release notes under PAN-115541.


Additional Information
How to fix Weak Ciphers and Keys on the Management Interface for SSH Access

Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/kcsArticleDetail?id=kA14u000000HBGL&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FkcsArticleDetail

Attachments
Choose Language