02-23-2016 07:46 AM - edited 03-12-2019 12:23 AM
Hi guys. I have a recommendation to switch from SSLv2 to SSLv3 , but I see there is bug at SSLv3 poodle bug. And Cisco recommend to disable sslv3 and enable tlsv1 .
on my ASA , version 9.2.3.4
"show ssl"
1 Accept connections using SSLv2 or greater and negotiate to TLSv1
2 Start connections using TLSv1 only and negotiate to TLSv1 only
3 Enabled cipher order: rc4-sha1 dhe-aes128-sha1 dhe-aes256-sha1 aes128-sha1 aes256-sha1 3des-sha1
-does line 1 and 2 mean that ASA already works with TLS instead of SSL ?
-if yes do i need still to switch to sslv3 and then do ASA(config)# ssl client-version tlsv1-only ?
How can i leave only AES 256-SHA1 encryption?
thank you
02-23-2016 08:23 AM
Hi,
Yes, the ASA supports tlsv1 in your current version. You can mention the client-version and server-version as tslv1 so that you do not hit the POODLE vulnerability.
Regarding the cipher settings on the ASA you can refer "ssl cipher" section in the below link
http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s16.html#pgfId-1724385
Thanks,
Shivapramod M
Please remember to select a correct answer and rate helpful posts
02-23-2016 12:35 PM
Thank you Shivapramod . But from your post its not clear :
do i need still to switch to SSLv3 and then do ASA(config)# ssl client-version tlsv1-only
ssl server-version tlsv1-only
or not ?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide