Cisco ISE 2.1 - SSH Server CBC Mode Ciphers Enabled

[PedroDias1994]

Hi,

After a Nessus scan, the report shows a vulnerability (Low) saying SSH Server CBC Mode Ciphers Enabled.

From other discussions, I can see two solutions, but both are for Cisco ISE 2.4 (and specific patches) and above:

1. service sshd encryption-mode ctr

2. service sshd encryption-algorithm aes128-ctr aes256-ctr

I have a Cisco ISE 2.1 implementation and my question is if there is any possibility to solve this vulnerability, since none of the commands above are acceptable...

Thank you for your help :)

[PedroDias1994]

From the Cisco ISE CLI Reference Guide, Release 2.1 I can see the Syntax Options on the attachment, but none are the same as the commands I mentioned above...

[poongarg · Accepted solution]

Hello Pedro,

From ISE 2.2 onwards, we have option to configure "service sshd encryption algorithm command" but not on ISE 2.1.

There is a defect CSCum13116 :Need ISE to Support aes256-ctr, aes256-ctr cipher for ISE as SSH client

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCum13116

This introduce the behavior change in ISE 2.7, where CBC ciphers as default will no longer be supported.

To disable CBC mode Ciphers on ISE 2.1, kindly open TAC case to apply the workaround of this defect, which need root access to the ISE node. Workaround need to be applied on all the nodes in the deployment.

[PedroDias1994]

Hi Poongarg,

Thank you very much for your reply and solution!

I will proceed accordingly.

Regards,

PD