DrayTek UK Users' Community Forum

Help, Advice and Solutions from DrayTek Users

Draytek SSL VPN PCI Compliance

  • gbrown100
  • Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
19 Jul 2015 04:31 #1 by gbrown100
Draytek SSL VPN PCI Compliance was created by gbrown100
We fail on this:

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection www (443/tcp)
CVE-2009-3555

Any work around?

Please Log in or Create an account to join the conversation.

  • darrent123
  • User is blocked
  • User is blocked
More
02 Sep 2015 08:51 #2 by darrent123
Replied by darrent123 on topic Re: Draytek SSL VPN NOT PCI Compliant
We fixed this by updating the firmware to 3.7.8.3.
Are you on the latest?

Please Log in or Create an account to join the conversation.

  • gbrown100
  • Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
22 Nov 2015 21:27 #3 by gbrown100
Replied by gbrown100 on topic Re: Draytek SSL VPN NOT PCI Compliant
3.8.1 finally introduced TLS 1.2 which resolved it. Unfortunately it broke a whole host of other functionality lol

Please Log in or Create an account to join the conversation.

More
23 Nov 2015 08:29 #4 by admin
Replied by admin on topic Re: Draytek SSL VPN NOT PCI Compliant

gbrown100 wrote: it broke a whole host of other functionality lol



Like what ?

Forum Administrator

Please Log in or Create an account to join the conversation.

  • gbrown100
  • Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
07 Dec 2015 22:45 #5 by gbrown100
Replied by gbrown100 on topic Re: Draytek SSL VPN NOT PCI Compliant
Sorry for delay,

We had issues with WAN2 failover not working correctly, DHCP not always working across VLANS. A few others I can't remember off the top of my head. All reported to SEG where we could quantify it.

Graham

Please Log in or Create an account to join the conversation.