Need to Block TLS 1.0 on Cisco FTD

[ShineSudheesh]

Dear All,

We have a server hosted on the inside network and clients are accessing that server from internet.We have FTD as our perimeter firewall.The requirement is to block TLS 1.0 connections to the Server.Please let me know how we can block the same on the FTD firewall.

[Karsten Iwen]

The first action is to disable it on the server. Then, on FTD, you can configure a control in the SSL-Policy:

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/understanding_traffic_decryption.html#id_106234

[ShineSudheesh]

@ Karsten Iwen

Do we require any specific license for the SSL policy creation?

[Karsten Iwen]

You need to have strong-encryption enabled, but no other license is needed.