topic Re: ciso ise in Network Access Control

ciso ise

bluesea2010 — Mon, 17 Apr 2023 05:58:44 GMT

Hi,

How to do the below in cisco ise

disable TLS Version 1.1 Protocol

SSL/TLS Diffie-Hellman Modulus from 1024 Bits to 2048 bits

Do I need to enable fips mode to disable tls 1.1?

What is the impact of enabling fips mode

Thanks

Re: ciso ise

Flavio Miranda — Mon, 17 Apr 2023 06:13:08 GMT

In ISE 2.4 is possible.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/release_notes/b_ise_24_rn.html#id_82769

Previous is not

FIPS is used for advanced security environment usually government environment. Enable this can have impact in other features. Read the documentation before enable FIPS.

Re: ciso ise

Marcelo Morais — Tue, 18 Apr 2023 04:02:12 GMT

Hi @bluesea2010 ,

disable TLS at Administration > Settings > Security Settings, remember that:

you don't need to disable FIPS to disable TLS.

You are able to FIPS Mode = Enabled at Administration > Settings > FIPS Mode.

Impacts of Enabling FIPS:

1st "... will cause an Application Server restart on ALL Deployment Nodes ...":

IMPORTANT: FIPS can not be enabled until you remove/edited ALL Allowed Protocols configured to use non-FIPS Compliant ... after FIPS Mode = Enabled and after clicking the Save button, you are able to check the non-FIPS Compliant protocols?

2nd ... please take a look at: Enabling FIPS on ISE & potential impact.

Hope this helps !!!