topic disable weak cipher on Cisco C881-K9 in Network Security

disable weak cipher on Cisco C881-K9

lingfongsim — Wed, 08 Apr 2020 14:26:18 GMT

during vulnerability scan on my hardware router.

SSH Server CBC Mode Ciphers Enabled and SSH Weak MAC Algorithms Enabled appears on the report

Recommendation are to disable CBC mode cipher encryption, and enable CTR or GCM cipher mode encryption and disable MD5 and 96-bit MAC algorithms respectively.

I google for answer but cannot seems to locate an answer for router for the above action.

Please advise, thanks

Re: disable weak cipher on Cisco C881-K9

ppreenja — Wed, 08 Apr 2020 15:08:10 GMT

Hi,

-upgrade to 15.5(2)T or later in order to be able to edit the ciphers.
-Enable CTR or GCM cipher mode encryption for SSH.
(config)# ip ssh server algorithm mac hmac-sha1 hmac-sha1-96
(config)# ip ssh server algorithm encryption aes128-ctr aes256-ctr

-Disable MD5 and 96-bit MAC algorithms for SSH.
(config)# no ip ssh server algorithm mac hmac-sha1-96

I hope the above helps.

Cheers,
Pratham

Re: disable weak cipher on Cisco C881-K9

lingfongsim — Thu, 09 Apr 2020 02:48:34 GMT

Hi Ppreenja,

Tks for the reply but I have check on the cisco site.

for my router, 881-k9, do not have 15.5, the latest is 15.4.3M10 MD

I believe this model is already EOL