topic Re: Need to Block TLS 1.0 on Cisco FTD in Network Security

Need to Block TLS 1.0 on Cisco FTD

ShineSudheesh — Tue, 14 Sep 2021 07:15:38 GMT

Dear All,

We have a server hosted on the inside network and clients are accessing that server from internet.We have FTD as our perimeter firewall.The requirement is to block TLS 1.0 connections to the Server.Please let me know how we can block the same on the FTD firewall.

Re: Need to Block TLS 1.0 on Cisco FTD

Karsten Iwen — Tue, 14 Sep 2021 07:24:33 GMT

The first action is to disable it on the server. Then, on FTD, you can configure a control in the SSL-Policy:

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/understanding_traffic_decryption.html#id_106234

Re: Need to Block TLS 1.0 on Cisco FTD

ShineSudheesh — Tue, 14 Sep 2021 07:32:10 GMT

@ Karsten Iwen

Do we require any specific license for the SSL policy creation?

Re: Need to Block TLS 1.0 on Cisco FTD

Karsten Iwen — Tue, 14 Sep 2021 07:35:11 GMT

You need to have strong-encryption enabled, but no other license is needed.