topic Re: Cisco Secure Firewall Threat Defense V7 in Network Security

Cisco Secure Firewall Threat Defense V7

Diallo — Fri, 13 Oct 2023 12:20:15 GMT

Hi guys,
I am asking you for help in activating my DH group 5

Re: Cisco Secure Firewall Threat Defense V7

balaji.bandi — Fri, 13 Oct 2023 12:42:23 GMT

its been deprecated 6.7 onwards :

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/relnotes/firepower-release-notes-670/m_features_functionality.html#id_110361

Re: Cisco Secure Firewall Threat Defense V7

Mark Elsen — Fri, 13 Oct 2023 12:43:55 GMT

- Its been flagged as depreciated , hence can no longer be activated ,

Re: Cisco Secure Firewall Threat Defense V7

Diallo — Fri, 13 Oct 2023 12:51:53 GMT

So there is no way to activate it???

Re: Cisco Secure Firewall Threat Defense V7

Diallo — Fri, 13 Oct 2023 12:54:51 GMT

So also there is no other possibility of using version 1 or 2

Re: Cisco Secure Firewall Threat Defense V7

Rob Ingram — Fri, 13 Oct 2023 12:58:33 GMT

@Diallo even on 7.3 you can still select DH group 5 to use in an IKEv2 policy. Although I would strongly recommend not doing so, as it's likely this will shortly be removed from FTD altogether (it has already been removed from ASA). I recommend you reconfigure the peer configuration to use a stronger DH group (19,20 or 21 etc).

Re: Cisco Secure Firewall Threat Defense V7

Diallo — Fri, 13 Oct 2023 13:17:53 GMT

I just have to use it in the creation of a VPN with a partner who uses ASA and tells me that he only uses versions 1,2 and 5.

With its status there can it work???

Re: Cisco Secure Firewall Threat Defense V7

Rob Ingram — Fri, 13 Oct 2023 13:21:45 GMT

@Diallo yes, but if you use DH group 5 (whilst it's still available to deploy) you will not be able to upgrade your FTD in future, as I already stated the weaker ciphers (including DH group 5) will be removed in upcoming releases. I would suggest the partner upgrades their software to support stronger crypto, the DH groups their software supports is weak and insecure.

Re: Cisco Secure Firewall Threat Defense V7

Marvin Rhoads — Fri, 13 Oct 2023 13:36:27 GMT

I had another customer's peer claim this as well. Often they are Just Wrong. ASA has supported IKEv2 with DH Group 14 since version 9.0 which is available even on the log-past-end-of-life ASA 5500 series (5505/5510/5520/5540/5550/5585).

https://community.cisco.com/t5/network-security/can-diffie-hellman-group-14-be-configured-on-asa5520-v9-1-6-11/td-p/3010274

Re: Cisco Secure Firewall Threat Defense V7

Diallo — Fri, 13 Oct 2023 13:46:33 GMT

@Rob Ingram thank you very much for your suggestions.
You are absolutely right, I will talk to the partner about updating their ASA if possible.

But in the meantime we are going to use group 5 there with its status like that.

Re: Cisco Secure Firewall Threat Defense V7

Diallo — Fri, 13 Oct 2023 13:53:07 GMT

@Marvin Rhoads thank you very much for your solution I see that this is possible with ASA5520 for group 14