01-23-2012 12:17 PM
How can you force the ACE to use a strong cipher for remote management through an HTTPS session? After viewing an SSLScan of the admin interface, multiple 56 and 40 bit ciphers are being allowed...
sslscan --no-failed 10.10.10.10 | grep -i accepted
Accepted SSLv3 168 bits EDH-RSA-DES-CBC3-SHA
Accepted SSLv3 168 bits DES-CBC3-SHA
Accepted SSLv3 128 bits DHE-RSA-AES128-SHA
Accepted SSLv3 128 bits AES128-SHA
Accepted SSLv3 128 bits RC4-SHA
Accepted SSLv3 128 bits RC4-MD5
Accepted SSLv3 56 bits EDH-RSA-DES-CBC-SHA
Accepted SSLv3 56 bits DES-CBC-SHA
Accepted SSLv3 40 bits EXP-EDH-RSA-DES-CBC-SHA
Accepted SSLv3 40 bits EXP-DES-CBC-SHA
Accepted SSLv3 40 bits EXP-RC4-MD5
I have tried to create an SSL parameter map, but I don't know where to apply it for remote access.
Thanks,
Tim
01-30-2012 05:44 AM
Hi Tim,
The SSL parameter maps apply only to load-balanced connections. For management, the only thing you can do is enable/disable access. The cipher list cannot be modified.
I wish I could give you a more satisfactory answer.
Regards
Daniel
01-31-2012 10:24 PM
This sounds like you are trying to verify and enforce security compliance based on a scan. Perhpas it would be acceptable to put an ACL on your management interface and then enforce use of strong ciphers on the client end (as opposed to the ACE end) with something like a GPO or manual configuration.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide