Specify a certificate, TLS protocol versions, and ciphers that you want connections
to various Palo Alto Networks services support.
| Where Can I Use This? | What Do I Need? |
|---|
- NGFW (Cloud Managed)
- NGFW (PAN-OS or Panorama Managed)
|
For cloud-managed NGFWs:
|
Palo Alto Networks firewalls and Panorama appliances use SSL/TLS to secure
connections to the Authentication Portal, GlobalProtect portals and gateways, the
management interface, HTTPS websites that require password access (URL admin
override), and the User-ID™ syslog listening service. You can create an SSL/TLS
service profile to define the server certificate, SSL/TLS protocol versions, and
ciphers supported for connections to these services. Cipher suites are automatically
selected based on the protocol versions chosen. However, you can disable individual
ciphers as needed. If a service request involves a protocol version outside the
specified range, the firewall or Panorama appliance downgrades or upgrades the
connection to a supported version. To activate an SSL/TLS service profile, attach
the profile to the settings for a specific service.
In the client systems that request firewall services, the certificate trust list
(CTL) must include the certificate authority (CA) certificate that issued the
certificate specified in the SSL/TLS service profile. Otherwise, users will see
a certificate error when requesting firewall services. Most third-party CA
certificates are present by default in client browsers. If an enterprise or
firewall-generated CA certificate is the issuer, you must deploy that CA
certificate to the CTL in client browsers.
TLSv1.3 support is limited to administrative access to
management interfaces and GlobalProtect portals and gateways. You can only attach
SSL/TLS service profiles that allow TLSv1.3 to the settings for these
services.
