topic Disabled SSH Weak MAC Algo and CBC mode Ciphers in Network Security

Disabled SSH Weak MAC Algo and CBC mode Ciphers

freddyliaw91 — Tue, 12 Mar 2019 06:40:07 GMT

I need a guidance on disabling ssh weak MAC Algorithms and SSH CBC mode ciphers.

I got a CISCO ASA 5510 device. Appreciate if someone could help me. Need advise urgently.

Hi, You can use following

Rishabh Seth — Wed, 30 Sep 2015 09:02:42 GMT

Hi,

You can use following command to see what are the configured algorithm:

# show run all ssl

Then based on our requirement you can use following command to remove/add ssl algorithms:

# ssl encryption <algo-name>

# no ssl encryption <algo-name>

Hope it helps!!!

Thanks,

R.Seth

Mark the answer as correct if it helps in resolving your query!!!

Thanks for prompt response.

freddyliaw91 — Wed, 30 Sep 2015 09:23:27 GMT

Thanks for prompt response. However, in my case is SSH not SSL.

Hi,I understand that you are

Rishabh Seth — Wed, 30 Sep 2015 09:41:17 GMT

Hi,

I understand that you are using ssh, but all the encryptions algorithms are configured under SSL hierarchy on ASA.

Refer:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s16.html#pgfId-1562163

Let us know if this helps in resolving your issue.

Thanks,

R.Seth

You can also refer:https:/

Rishabh Seth — Wed, 30 Sep 2015 09:59:34 GMT

You can also refer:

https://supportforums.cisco.com/discussion/12209596/how-disable-aes-cbc-encryption-asa-5545

The command has been applied.

freddyliaw91 — Wed, 30 Sep 2015 12:11:07 GMT

The command has been applied.

However, we still can see the encryption key.

Please, see the attachment for the result.

Hi, Use "show run ssl" to see

Rishabh Seth — Wed, 30 Sep 2015 12:30:16 GMT

Hi,

Use "show run ssl" to see the ssl encryption algorithm in your running configuration.

I think you will not see the encryption algo in running configuration as you have deleted it.

Hope it helps!!!

Thanks,

R.Seth

Mark the answer as correct if it helps in resolving your query!!!

You can change ssl settings

Rishabh Seth — Wed, 30 Sep 2015 12:39:28 GMT

You can change ssl settings via ASDM as well.

Navigate through Configuration > Device Management > SSL Settings.

Under this hierarchy you can easily check what is active and based on your requirement you can edit the settings.

Hope it helps!!!

Thanks,

R.Seth

Hi,The issue still remain the

freddyliaw91 — Tue, 13 Oct 2015 08:25:57 GMT

Hi,

The issue still remain the same. I still able to connect with weak ciphers