Disabling TLS v1.1 at sw

[Leftz]

Hi There is security vulnerability issue on C9300 sw due to TLS version. Is there a command to disable TLS version 1.1 and 1.0? Thanks

[balaji.bandi]

use strong ciphers  and ssh ver 2

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-6/configuration_guide/sec/b_166_sec_9300_cg/configuring_secure_socket_layer_http.html

[Leftz]

Thanks for your reply. the switch use TLS, we need to disable lower version v1.1

PSW#sh ip http server all | i TLS
HTTP secure server TLS version: TLSv1.2 TLSv1.1

[balaji.bandi · Accepted solution]

(config)#ip http tls-version tlsv1.2
(config)#ip http tls-version ?

  TLSv1.0  Set TLSv1.0 version Only
  TLSv1.1  Set TLSv1.1 version Only
  TLSv1.2  Set TLSv1.2 version Only

(config)#ip http secure-ciphersuite ? 
   aes-128-cbc-sha            Encryption type tls_rsa_with_aes_cbc_128_sha ciphersuite
  aes-256-cbc-sha            Encryption type tls_rsa_with_aes_cbc_256_sha ciphersuite
  dhe-aes-128-cbc-sha        Encryption type tls_dhe_rsa_with_aes_128_cbc_sha ciphersuite
  edche-rsa-aes-256-cbc-sha  Encryption type tls_ecdhe_rsa_aes_256_cbc_sha ciphersuite

• HTTPS Server command -- By default, it supports three versions. If you want to use a particular
version for the sessions, you can specify by configuring the ip http tls-version command in global
configuration mode. The versions are TLSv1.0, TLSv1.1, and TLSv1.2.
• HTTPS Client command -- By default, it supports three versions. If you want to use a particular
version for the sessions, you can specify by configuring the ip http client tls-version command
in global configuration mode. The versions are TLSv1.0, TLSv1.1, and TLSv1.2.

[Leftz]

Very good explanation! Thank you!