PAN-OS 11.1 GlobalProtect Cipher Suites

Table of Contents

PAN-OS 11.1 GlobalProtect Cipher Suites

List of cipher suites supported for GlobalProtect™ on firewalls running PAN-OS® 11.1 in normal operation mode.

The following table lists cipher suites for GlobalProtect™ supported on firewalls running a PAN-OS® 11.1 release in normal (non-FIPS-CC) operational mode.

If your firewall is running in FIPS-CC mode, see the list of PAN-OS 11.1 Cipher Suites Supported in FIPS-CC Mode.

GlobalProtect App/Agent—SSL tunnels and SSL connections to gateway and portal
GlobalProtect App/Agent—IPSec mode
GlobalProtect Portal—Browser Access

Feature or Function	Ciphers Supported in PAN-OS 11.1 Releases
GlobalProtect App/Agent—SSL tunnels and SSL connections to gateway and portal	TLSv1.0, TLSv1.1, TLSv1.2, and TLSv1.3 cipher suites RSA-SEED-SHA-1 RSA-CAMELLIA-128-SHA-1 RSA-CAMELLIA-256-SHA-1 RSA-3DES-SHA-1 RSA-AES-128-SHA-1 RSA-AES-256-SHA-1 RSA-AES-128-SHA-256 RSA-AES-256-SHA-256 RSA-AES-128-GCM-SHA-256 RSA-AES-256-GCM-SHA-384 DHE-RSA-SEED-SHA-1 DHE-RSA-AES-128-SHA-1 DHE-RSA-AES-256-SHA-1 DHE-RSA-AES-128-GCM-SHA-256 DHE-RSA-AES-256-GCM-SHA-384 EDH-RSA-3DES-SHA-1 ECDHE-RSA-AES-128-SHA-1 ECDHE-RSA-AES-256-SHA-1 ECDHE-RSA-AES-128-GCM-SHA-256 ECDHE-RSA-AES-128-GCM-SHA-384 ECDHE-ECDSA-AES-128-SHA-1 ECDHE-ECDSA-AES-256-SHA-1 ECDHE-ECDSA-AES-128-GCM-SHA-256 ECDHE-ECDSA-AES-256-GCM-SHA-384 TLS-AES-128-GCM-SHA256 TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256
GlobalProtect App/Agent—IPSec mode (Keys transported through SSL session with gateway)	AES-128-CBC-HMAC-SHA-1 AES-128-GCM-HMAC-SHA-1 AES-256-GCM-HMAC-SHA-1
GlobalProtect Portal—Browser Access	SSLv3, TLSv1.0, TLSv1.1, and TLSv1.2 cipher suites RSA-SEED-SHA-1 RSA-CAMELLIA-128-SHA-1 RSA-CAMELLIA-256-SHA-1 RSA-3DES-SHA-1 RSA-AES-128-SHA-1 RSA-AES-256-SHA-1 RSA-AES-128-SHA-256 RSA-AES-256-SHA-256 RSA-AES-128-GCM-SHA-256 RSA-AES-256-GCM-SHA-384 DHE-RSA-AES-256-SHA-1 DHE-RSA-AES-128-SHA-1 DHE-RSA-AES-128-GCM-SHA-256 DHE-RSA-AES-256-GCM-SHA-384 EDH-RSA-3DES-SHA-1 ECDHE-ECDSA-AES-128-SHA-1 ECDHE-ECDSA-AES-256-SHA-1 ECDHE-ECDSA-AES-128-GCM-SHA-256 ECDHE-ECDSA-AES-256-GCM-SHA-384

Cipher Suites Supported in PAN-OS 11.1

PAN-OS 11.1 IPSec Cipher Suites

Compatibility Matrix

PAN-OS 11.1 GlobalProtect Cipher Suites

Compatibility Matrix

PAN-OS 11.1 GlobalProtect Cipher Suites

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Network Security

Visibility & Monitoring

Best Practices

Experts Corner