Disabling TLS 1.0 on ASA

[Nub65]

Hello,

Due to security reasons, we were advised to disable TLS 1.0 on ASA.

My concern is what might go wrong after disabling it?

[Rob Ingram · Accepted solution]

Hi,
TLS would be used for managment via ASDM and if enabled SSL-VPN. You probably want to be running TLS 1.2 as a minimum.

You should ensure you are running ASA version 9.10 or higher and AnyConnect 4.7 or higher, which supports TLS/DTLS 1.2.
You should also upgrade or check you are running an version of java that supports TLS 1.1/1.2, otherwise you would not be able to login to ASDM.

HTH

[Brad_Shawh · Accepted solution]

We recently upgraded to TLS 1.2, and we are currently on Anyconnect 4.4

@Nub65  As is, you won't face any issue, unless the clients (connecting to VPN) do not support TLS version you are configuring.

[Marvin Rhoads · Accepted solution]

I regularly disable TLS 1.1 and earlier versions on ASAs I configure. As long as you are running current ASA and AnyConnect releases (and Java on the client side for ASDM) as @Rob Ingram mentioned there should be no negative impact.