Disabling SSH CBC cipher on Cisco routers/switches

[sulaimangd]

hi,

is there a way to disable weak ciphers on Cisco Switches, i know we can enable strong ciphers through

ip ssh server algorithm encryption aes128-ctr aes256-ctr

but is there a way to completely disable them. same goes for weak MAC algorithms?

[sulaimangd]

Just to update on the issue.

it seems that the command 

ip ssh server algorithm encryption aes128-ctr aes256-ctr

is not available on this switch.

im using 4500-x with IOS-XE 03.04.06.SG.

any ideas?

Thanks 

[Rob Ingram]

Hi,
To answer your original question, if you define only aes256-ctr aes128-ctr (you would want to define the strongest first) then only those encryption ciphers will be allowed, therefore the weaker ciphers will be disabled. Combine that will an ACL on the VTY lines to further secure access to the devices.

That IOS firmware version is pretty old, I would be surprised if a newer IOS version did not support those commands.

HTH

[sulaimangd]

Thanks for the reply

which version does likely include those commands?

Thanks 

[Rob Ingram]

I think it was introduced in IOS 15.5(2), reference here...but unfortunately I don't think the 4500-X latest version appears to go up to 15.5.