cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
292
Views
0
Helpful
9
Replies
Highlighted
Beginner

Cisco SMA Configure Cipher Suite

Hi,

 

I tried to update SMA cipher using cli (sslconfig) but not able to do it because SMA does not behave the same as ESA.

 

I found from other discussion that for SMA, I need to change the configuration on the config file and then upload the config file back. Based on our past experience, we have encountered a situation where after the config file is uploaded, not all configuration was restored.

 

Is there any other way I can update our SMA cipher config?

 

Thank you.

 

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Cisco SMA Configure Cipher Suite

Hi A.zahid,

To the best of my knowledge, the steps provided is the only way to adjust SSL ciphers in SMA by making changes in the configuration file.
However, I understand that you had faced issue last time while restoring the configuration as all the configuration was not restored.
To make sure the similar incident don't next time, you can take below precautions while performing the change next time:

1) Make sure that you download the configuration file which is plain or encrypt as mask configuration will not be uploaded after making the changes.
2) Once the required changes are made, I would request you to make use of the text comparison tool that only SSL configuration is changed and no other configuration changes are in place.

If you still face any issue, please feel free to reach out to Cisco TAC and we'll be happy to assist you further.

BR,
Pratham
9 REPLIES 9
Cisco Employee

Re: Cisco SMA Configure Cipher Suite

Hi,

To adjust the SSL ciphers for the SMA you can do this by performing the below steps.

The sslconfig part of command that allows changing ciphers is not available for the Cisco SMA as such you will have to perform the below steps:

1. Save the SMA configuration file to your local computer. Make sure passwords are unmasked or this will not work.
2. Open the XML file.
3. Search for the <ssl> section in the XML. It will look like the below:

EXAMPLE:
<ssl>
<ssl_inbound_method>sslv3tlsv1</ssl_inbound_method>
<ssl_inbound_ciphers>RC4-SHA:RC4-MD5:ALL</ssl_inbound_ciphers>
<ssl_outbound_method>sslv3tlsv1</ssl_outbound_method>
<ssl_outbound_ciphers>RC4-SHA:RC4-MD5:ALL</ssl_outbound_ciphers>
<ssl_gui_method>sslv3tlsv1</ssl_gui_method>
<ssl_gui_ciphers>RC4-SHA:RC4-MD5:ALL</ssl_gui_ciphers>
</ssl>


4. Modify the ciphers as desired and save the XML.

EXAMPLE:
<ssl>
<ssl_inbound_method>tlsv1</ssl_inbound_method>
<ssl_inbound_ciphers>MEDIUM:HIGH:-SSLv2:-aNULL:@STRENGTH</ssl_inbound_ciphers>
<ssl_outbound_method>tlsv1</ssl_outbound_method>
<ssl_outbound_ciphers>MEDIUM:HIGH:-SSLv2:-aNULL:@STRENGTH</ssl_outbound_ciphers>
<ssl_gui_method>tlsv1</ssl_gui_method>
<ssl_gui_ciphers>MEDIUM:HIGH:-SSLv2:-aNULL:@STRENGTH</ssl_gui_ciphers>
</ssl>

5. Load the new configuration file onto the SMA.
6. Submit and commit all changes.

I hope this helps.

BR,
Pratham
Beginner

Re: Cisco SMA Configure Cipher Suite

Hi pprenja,

 

Is there any other way to do it? Based on our past experience, we have encountered a situation where after the config file is uploaded, not all configuration was restored.

 

Thanks

Cisco Employee

Re: Cisco SMA Configure Cipher Suite

Hi A.zahid,

To the best of my knowledge, the steps provided is the only way to adjust SSL ciphers in SMA by making changes in the configuration file.
However, I understand that you had faced issue last time while restoring the configuration as all the configuration was not restored.
To make sure the similar incident don't next time, you can take below precautions while performing the change next time:

1) Make sure that you download the configuration file which is plain or encrypt as mask configuration will not be uploaded after making the changes.
2) Once the required changes are made, I would request you to make use of the text comparison tool that only SSL configuration is changed and no other configuration changes are in place.

If you still face any issue, please feel free to reach out to Cisco TAC and we'll be happy to assist you further.

BR,
Pratham
Beginner

Re: Cisco SMA Configure Cipher Suite

Hi pprenja,

 

Thanks for your explanation and recommendation. Really appreciate it.

 

Thanks.

Collaborator

Re: Cisco SMA Configure Cipher Suite

I've asked for an enhancement request.  CSCvq97177

 

Totally silly that this is an issue as the ESA has it available via gui and CLI. 

 

Beginner

Re: Cisco SMA Configure Cipher Suite

Hi,

 

It should have been same for both sma and esa. Did Cisco mention when will this enhancement be onboard?

 

Thanks.

Cisco Employee

Re: Cisco SMA Configure Cipher Suite

Hello,

Currently, there is no ETA on the enhancement as backend teams are working on the same. The enhancement has been filed on Aug 20,2019 itself and as soon as it link for the same is made public, you can add yourself to the notification and get updates directly once any fix is announced.

Cheers,
Pratham
Beginner

Re: Cisco SMA Configure Cipher Suite

Hi pprenja,

 

Thanks for the information. :)

 

Thanks.

Cisco Employee

Re: Cisco SMA Configure Cipher Suite

Hi A.zahid,

Happy to help! :)

Cheers,
Pratham