topic Re: Cisco Firepower User Agent support for TLSv1.2 in Network Security

Cisco Firepower User Agent support for TLSv1.2

borman.bravo — Fri, 21 Feb 2020 17:45:13 GMT

Can someone please confirm if the Firepower user agent 2.4 supports TLSV1.2? I disabled TLSV1.0 in my Windows Domain Controller 2016 and I'm not getting any mappings anymore, thank you.

Re: Cisco Firepower User Agent support for TLSv1.2

Marvin Rhoads — Tue, 10 Dec 2019 03:11:10 GMT

User Agent to FMC should support strong ciphers.

Reference: https://www.cisco.com/c/en/us/td/docs/security/firesight/user-agent/24/config-guide/Firepower-User-Agent-Configuration-Guide-v2-4/ConfigAgent.html

Is your User Agent running on the DC itself?

Re: Cisco Firepower User Agent support for TLSv1.2

borman.bravo — Tue, 10 Dec 2019 14:32:28 GMT

Hi Marvin, yes it is running in the domain controllers, thanks

Re: Cisco Firepower User Agent support for TLSv1.2

nspasov — Wed, 11 Dec 2019 03:13:03 GMT

I would recommend reaching out to Cisco TAC to have this verified but the last time I checked the User Agent only supported TLSv1.0.

Thank you for rating helpful posts!

Re: Cisco Firepower User Agent support for TLSv1.2

borman.bravo — Mon, 06 Jan 2020 19:17:04 GMT

Thank you for your reply and Happy New Year!

The article you referred me to has no mention of TLS v1.2 support for User Agent which is the question I had, would you know if this is supported in 6.4?

Re: Cisco Firepower User Agent support for TLSv1.2

dotran — Fri, 10 Apr 2020 14:07:21 GMT

I'm seeing a similar issue. According to this, no. https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve30062/?rfs=iqvred

I'm flabbergasted by the suggested workaround. Is this a push to get people off the FREE User agent and requiring a license ICE product.........

CSCve30062

Symptom:
User agent cannot communicate with the Firepower Management Center. The following error is displayed on the user agent:

[The client and server cannot communicate, because they do not possess a common algorithm]

Conditions:
The server hosting the user agent has TLS 1.0 disabled.

Workaround:
Enable TLS 1.0 on the machine where user agent is running. If security policy forbids enabling TLS 1.0 on that machine, install the user agent on a different machine. (For security reasons, you might not want the TLS 1.0 to run on your Active Directory server, for example.)

Re: Cisco Firepower User Agent support for TLSv1.2

Joshua Edwards — Wed, 29 Apr 2020 18:31:35 GMT

It definitely is, the user agent is going out of support and our fixes are to either re-enable TLS 1.0 (can't happen) or utilize ISE-PIC. We don't currently utilize ISE in our environment, so in order to have this functionality we would have to bring it in.

Re: Cisco Firepower User Agent support for TLSv1.2

borman.bravo — Wed, 29 Apr 2020 19:52:29 GMT

Yes, that is my understanding as well now, was informed by TAC that ISE-PIC was the recommended approach...either that or replace with Palos 🙂