DNA - Topic about encryption

[fongaratto]

Hello team,

After scanning vulnerabilities at the Cisco DNA Center, it was found that:

- Replace the 'Diffie-Hellman' with a safer group;

"The remote server is affected by a cryptographical weakness.
Disable weak cipher suites in the server's configuration.
It is recommended to use ECDH cipher suites instead and generate a strong, unique Diffie Hellman Group (2048-bit or stronger)".

- Increase the private key to 2048 bits or more.

"The remote server is affected by a cryptographical weakness.
Configure your SSH server so it uses moduli longer than 1024 bits and make sure that the diffie-hellman-group1-sha1 algorithm is disabled."

I couldn't find documentation with steps on how to perform these procedures.

Some direction?

All the best

[inderdeeps]

@fongaratto : Check you check this document " Certificate and Private key"

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-3/admin_guide/b_cisco_dna_center_admin_guide_1_3/b_dnac_admin_guide_1_3_chapter_010.html#concept_bhp_jb2_rbb 

[fongaratto]

Hello,

I saw this and many other links, unfortunately, I did not find the procedure I need in them.

Still, I appreciate your help.

Best regards.

[balaji.bandi · Accepted solution]

After scanning vulnerabilities at the Cisco DNA Center, it was found that:

We are not sure what scanning you did for what ports ? you need to provide complete output.

as per the suggestion if you looking HTTPS Look at the below guide : (this is based on assumption that you have vulnerable https)

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/hardening_guide/b_dnac_security_best_practices_guide.html

[fongaratto]

Hello,

Below includes what I need help doing:

Findings 1:
"The remote server is affected by a cryptographical weakness.
Configure your SSH server so it uses moduli longer than 1024 bits and make sure that the diffie-hellman-group1-sha1 algorithm is disabled."

Findings 2:
"The remote server is affected by a cryptographical weakness.
Disable weak cipher suites in server's configuration.
It is recommended to use ECDH cipher suites instead and generate a strong, unique Diffie Hellman Group (2048-bit or stronger)".

I appreciate the help and attention.

[balaji.bandi]

The above document should be able to help you to get new one.