Perfect Forward Secrecy (PFS) Support

The firewall now supports Perfect Forward Secrecy (PFS) for SSL Forward Proxy decrypted sessions. PFS is a secure communication protocol that prevents the compromise of one encrypted session from leading to the compromise of multiple encrypted sessions. With PFS, a server generates unique private keys for each secure session that it establishes with a client. If a server private key is compromised, only the single session established with that key is vulnerable—an attacker cannot retrieve data from past and future sessions because the server establishes each connection with a uniquely generated key.

In releases prior to PAN-OS 7.1, the firewall did not decrypt SSL sessions established using PFS key exchange algorithms. Depending on your security policy, the firewall either blocked these SSL sessions without decrypting them or decrypted the SSL sessions without maintaining PFS. Now, for SSL sessions established with PFS key exchange algorithms, the firewall both decrypts the SSL session and preserves PFS protection for both past and future sessions.

Decryption support for ephemeral Diffie-Hellman (DHE)-based PFS and elliptic curve Diffie-Hellman (ECDHE)-based PFS is enabled by default when you upgrade a firewall to PAN-OS 7.1 for sessions decrypted with the SSL Forward Proxy decryption method. You can disable support for these PFS key exchange algorithms by modifying the firewall decryption profile you apply to SSL Forward Proxy decrypted traffic.