topic Key exchange algorithms on 6504E in Network Security

Key exchange algorithms on 6504E

andromeda — Fri, 01 May 2020 19:14:42 GMT

Could someone here please help me answer this question: have a 6504E running on 15.5(1)SY5 (latest) and need to know if its KEX algorithms can be updated somehow to a more modern set, currently only supporting diffie-hellman-group-exchange-sha1.

Thanks!

Re: Key exchange algorithms on 6504E

balaji.bandi — Fri, 01 May 2020 19:34:46 GMT

here is the latest information :

https://community.cisco.com/t5/security-documents/guide-to-better-ssh-security/ta-p/3133344

Re: Key exchange algorithms on 6504E

andromeda — Fri, 01 May 2020 19:47:44 GMT

Thanks, appreciate it. However that doesn't cover KEX on the cisco switch...

Re: Key exchange algorithms on 6504E

Marius Gunnerud — Fri, 01 May 2020 20:26:24 GMT

You could try the following command (replace <size> with the value you need or use ? to see what is available):

ip ssh dh min size <size>

Re: Key exchange algorithms on 6504E

andromeda — Fri, 01 May 2020 21:15:28 GMT

Thank you, but that also doesn't address my concern. The KEX available still show dh with sha-1 only.

Re: Key exchange algorithms on 6504E

Marius Gunnerud — Sat, 02 May 2020 08:04:58 GMT

Came across this document. Hopefully it will point you in the right direction.

https://community.cisco.com/t5/security-documents/guide-to-better-ssh-security/ta-p/3133344

Re: Key exchange algorithms on 6504E

andromeda — Sat, 02 May 2020 22:15:04 GMT

Thanks, that's the same doc shared on the 1st reply. Unfortunately it does not address my question.