Changes in CBC ciphers and TLS

[bvj197222]

We're using Cisco ASAv 9.10 together witch Cisco Anyconnect 4.7 clients. Due to the Poodle voulnerability and other vulnerabilities I'm doing some changes in CBC ciphers, and we're turning off TLS 1/1.1, plus changing from Diffie-Hellman group2 to group14. Are there any preparations/changes that needs to be done on the Anyconnect clients prior to this?

[Rob Ingram]

Hi,

You are running the minimum versions of ASA and AnyConnect to support the latest ciphers. Ensure you use DTLS 1.2 as this has the best performance.Running TLS 1.2 and DTLS 1.2 will ensure you are using the latest cipher AES-GCM.

If you run the command show vpn-sessiondb detail anyconnect you can confirm what ciphers you are currently using, before you make any changes.

Useful link for performance and scaling AnyConnect VPNs:-

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215331-anyconnect-implementation-and-performanc.html#anc4

HTH