Hello,
Could someone clarify the following question, please?
Due to this Advisory ID cisco-sa-20180129-asa1, I upgraded from version 9.6(3)20 to version 9.6.4(3) as indicated.
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1
According to the information, the upgrade would fix the vulnerability. So we could continue to use the Features without problems, right?
In this case, I use AnyConnect IKEv2 Remote Access (with client services) and I need to continue using it.
If I continue to use this feature, will I still be at risk?
Are the SSL and DTLS listen sockets output above normal or should they be different after the upgrade?
--------------------------------------------
::: ASA device with SSL and DTLS listen sockets:
asa# show asp table socket | include SSL|DTLS
SSL 00013b78 LISTEN 123.123.123.123:443 0.0.0.0:*
DTLS 000143e8 LISTEN 123.123.123.123:443 0.0.0.0:*
--------------------------------------------
::: Feature:
AnyConnect IKEv2 Remote Access (with client services)
--------------------------------------------
::: Configuration:
asa# show running-config crypto ikev2 | include enable
crypto ikev2 enable outside client-services port 443
--------------------------------------------
::: SSL system statistics
asa# show asp table socket stats protocol ssl
NP SSL System Stats:
Handshake Started: 1012
Handshake Complete: 890
SSL Open: 11
SSL Close: 1703
SSL Server: 1066
SSL Server Verify: 0
SSL Client: 0
--------------------------------------------
Thanks!
Att,
Flavio
