Disable SSL Block Chaining on Firepower for Client Remote Access

[macloughs]

Hi, my company uses a Cisco 4115 FTD version 7.2.7 to provide remote access for company employees. Cisco Secure Client and Cisco ISE are used as part of this solution. In a recent penetration test, the auditors advised that we disable cipher suites that operate in CBC mode on these devices. The reason they gave is that these cipher suites have the potential to leak information if used improperly.
We manage these devices through an FMC running 7.4.1.1. I have tried to determine how I can disable these suites but to no avail. Can anyone advise how to do this and also, whether it is a valid concern on behalf of the auditor?

Thanks

[MHM Cisco World · Accepted solution]

Check this 

https://integratingit.wordpress.com/2021/01/28/secure-ftd-tls-ciphers/

MHM

[Marvin Rhoads]

The procedure is also covered in this community thread:

https://community.cisco.com/t5/vpn/anyconnect-perfect-forward-secrecy/td-p/3324415

FYI you should also upgrade to 7.2.9 or 7.4.2.1 to address other recent security vulnerabilities announced by Cisco.

https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300

[macloughs]

Thanks guys for the help. That was what I was looking for.