Cisco VoIP phone 7945G VPN and TLS version

[fsebera]

We need to disable TLS1.0 and TLS1.1 on our ASA VPN gateway (Cisco 5516-X)

I see VPN users and VPN phones are syncing up to the ASA VPN gateway with TLS 1.0

I see in the Cisco docs the Cisco AnyConnect VPN client 4.x and up supports TLS.1.2.

Anyone know if the Cisco 7945G VoIP phones will support TLS 1.2  or where I can obtain additional details?

Thank you

Frank

[Jaime Valencia]

Right now only the 78XX and 88XX support TLS 1.2, the 79XX will not support 1.2

[fsebera]

Ahhhhh, bummer.

Would you happen to have any URLs speaking on this topic --PLEASE!!!!

Thank You

Frank

[Jaime Valencia · Accepted solution]

When connected to Cisco Unified Communications Manager Release 10.5(2) and later, the phones support AES 256 encryption support for TLS and SIP for signaling and media encryption. This enables phones to initiate and support TLS1.2 connections using AES-256 based ciphers that conform to SHA-2 (Secure Hash Algorithm) standards and are Federal Information Processing Standards (FIPS) compliant

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cuipph/8800-series/english/adminguide/P881_BK_C136782F_00_cisco-ip-phone-8800_series.html#P881_RF_S386401D_00

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cuipph/7800-series/10-3-1/english/releasenotes/PA2D_BK_70AD4CFB_00_7811_7821_7841_7861-rn-1031/PA2D_BK_70AD4CFB_00_7811_7821_7841_7861-rn-1031_chapter_00.html#PA2D_RF_AC3FD7DF_00

[fsebera]

Hi Jaime,

Thank you, you got me on the right path!

Frank

[iverson.justin]

Is there a document that just talks about SSL anyconnect and what phones except TLS 1.2?  

[smgroene01]

I know this is reaaaaally old but we still have some old 79XX series phones in our environment. Slowly but surely we are phasing them out. But i am wondering if these 79XX phones support TLS 1.1. I think i've seen that they only support TLS 1.0 but cannot find any source that confirms this for my security folks. Can you provide a link to a datasheet that addresses this? Thank you!

[Stephanie Knoop]

Per this bug and this other document, there are references to 7900 series not being supported with anything above TLS 1.0. Search for 7900 and you will find what I'm talking about. Interestingly, though, there is a section about workarounds for these phones for certain features. Hopefully this answers your question definitively.

https://quickview.cloudapps.cisco.com/quickview/bug/CSCvj26615

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/uc_system/TLS/TLS-1-2-for-On-Premises-Cisco-Collaboration-Deployments.html

[smgroene01]

Thank you Stephanie! think I've got what i need here. We are planning an upgrade to 12.6 in 2023 but need to know what we can do to satisfy our security folks in the meantime. I appreciate it!

[imranjabbar245]

A bit old but what I do is a workaround for security folks. Disable Web Access on Phone Configuration page for the specific extensions or in Phone template for the specific model. Then there would be no vulnerabilities in scan results of VA scanner.