I need to filter out all SSL Downgrade requests

[ryderse69]

I am looking for a way to filter out all SSL Downgrade attempts for traffic passing through my FWSMs and/or ASAs. 

This traffic (the request to downgrade to a weaker cipher) is sent in the clear so this should be filterable by a FW somehow. 

I found this Cisco IPS rule that alerts when such traffic is encountered:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=5891&signatureSubId=1&softwareVersion=6.0&releaseVersion=S866

How can I filter out all SSL downgrade attempts for traffic flowing through an FWSM or ASA? This should be possible. 

Thank you in advance:

-SR

[ryderse69]

I found a similar discussion on Sonicwall that include some packet capture info but I can't tell yet what I can filter on. 

I'm told that in the client hello an export cipher (weaker cipher) is where the downgrade request is sent to the server. 

https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=792

[Kanwaljeet Singh]

Hi,

For the traffic flowing through, i need to see if that is possible. 

Above was for traffic destined to the FW.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[ryderse69]

If you could check, that would be extremely helpful. 

Thank you. 

[ryderse69]

Official word from TAC is that this must be done with an IPS. This can not be done on an ASA/FWSM without one. 

I had hoped to use some inspect rules or the like but I guess not :-/. 

[Kanwaljeet Singh]

Hi,

You can only configure selected ciphers on ASA so that only those are negotiated during the SSL handshake. Any attempt to negotiate on weak ciphers or the one's not included in cipher list would fail.

ssl encryption xxxxx xxxxx

Regards,

Kanwal

Note:Please mark answers if they are helpful.

[ryderse69]

Hi Kanwal

Is this applicable to traffic flowing through the FW or destined to it?

I'm not concerned about traffic destined to the FW, I need to filter out this traffic flowing between hosts connected to the FW. 

Thank you

SR