topic Re: Disable SSL Block Chaining on Firepower for Client Remote Access in Network Security

Disable SSL Block Chaining on Firepower for Client Remote Access

macloughs — Thu, 07 Nov 2024 16:27:07 GMT

Hi, my company uses a Cisco 4115 FTD version 7.2.7 to provide remote access for company employees. Cisco Secure Client and Cisco ISE are used as part of this solution. In a recent penetration test, the auditors advised that we disable cipher suites that operate in CBC mode on these devices. The reason they gave is that these cipher suites have the potential to leak information if used improperly.
We manage these devices through an FMC running 7.4.1.1. I have tried to determine how I can disable these suites but to no avail. Can anyone advise how to do this and also, whether it is a valid concern on behalf of the auditor?

Thanks

Re: Disable SSL Block Chaining on Firepower for Client Remote Access

MHM Cisco World — Thu, 07 Nov 2024 19:01:19 GMT

Check this

https://integratingit.wordpress.com/2021/01/28/secure-ftd-tls-ciphers/

MHM

Re: Disable SSL Block Chaining on Firepower for Client Remote Access

Marvin Rhoads — Fri, 08 Nov 2024 04:28:03 GMT

The procedure is also covered in this community thread:

https://community.cisco.com/t5/vpn/anyconnect-perfect-forward-secrecy/td-p/3324415

FYI you should also upgrade to 7.2.9 or 7.4.2.1 to address other recent security vulnerabilities announced by Cisco.

https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300

Re: Disable SSL Block Chaining on Firepower for Client Remote Access

macloughs — Mon, 11 Nov 2024 09:59:11 GMT

Thanks guys for the help. That was what I was looking for.