Good day,
Our Cisco Router 1921 Series failed PCI scans on Weak IPsec Encryption Settings port 500/udp. More information on the scan results,
THREAT:
This host contains an ISAKMP/IKE key exchange server to negotiate encryption keys for IPsec Virtual Private Networks (VPNs). The configuration of the server allows clients to establish VPN connections with insecure encryption settings or key lengths. Once established, these connections may allow remote malicious users with access to the VPN data stream to recover the session key used in the connection by performing brute-force key space searches.
Note: This QID will be reported as a Potential Vulnerability (not as a Vulnerability) on some versions of IOS because an ISAKMP SA with weak settings can be established first, and then rejected later by a policy check. Without having VPN authentication credentials, it is impossible to differentiate between this type of setup and a setup that truly allows ISAKMP SA with weak settings.
IMPACT:
A malicious user with access to the VPN data stream may be able to recover the session key of a VPN connection. This would then provide access to all data sent across the VPN connection, which may include passwords and sensitive files.
SOLUTION:
Disable the encryption algorithm "DES" (key length of 56 bits) and the key exchange algorithm DH768 (MODP768). Secure replacements are 3DES and DH2048. MSFT has further details under Microsoft Guidance : What is IPSEC?.
Patch: Following are links for downloading patches to fix the vulnerabilities:
bb531150: MSFT IPSEC
RESULT:
Algorithm Description
DES Data Encryption Standard (56 bits)
DH768(MODP768) Diffie-Hellman Key Exchange with 768 bits
These are the IPSec parameters we have,
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 28800
!
crypto isakmp policy 2
encr aes 256
authentication pre-share
group 5
crypto isakmp key D0MM7MNn7t address *
crypto isakmp key T676uR17G0nN7c7B address *
crypto ipsec transform-set * esp-aes 256 esp-sha-hmac
mode tunnel
crypto ipsec transform-set * esp-3des esp-sha-hmac
mode tunnel
!
crypto map BOB 40 ipsec-isakmp
set peer *
set security-association lifetime seconds 1800
set transform-set *
match address 5
crypto map BOB 60 ipsec-isakmp
set peer *
set security-association lifetime seconds 86400
set transform-set *
set pfs group2
match address 1
There is is no DES or group 1 configured on tunnels. May you please help advise on the possible remediation.
Regards
Nel
