cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
2015
Views
0
Helpful
4
Replies
sulaimangd
Beginner

Disabling SSH CBC cipher on Cisco routers/switches

hi,

 

is there a way to disable weak ciphers on Cisco Switches, i know we can enable strong ciphers through

 

ip ssh server algorithm encryption aes128-ctr aes256-ctr

 

but is there a way to completely disable them. same goes for weak MAC algorithms?

 

4 REPLIES 4
sulaimangd
Beginner

Just to update on the issue.

 

it seems that the command 

ip ssh server algorithm encryption aes128-ctr aes256-ctr

is not available on this switch.

im using 4500-x with IOS-XE 03.04.06.SG.

 

any ideas?

Thanks 

 

Hi,
To answer your original question, if you define only aes256-ctr aes128-ctr (you would want to define the strongest first) then only those encryption ciphers will be allowed, therefore the weaker ciphers will be disabled. Combine that will an ACL on the VTY lines to further secure access to the devices.

That IOS firmware version is pretty old, I would be surprised if a newer IOS version did not support those commands.

HTH

Thanks for the reply

 

which version does likely include those commands?

 

Thanks 

I think it was introduced in IOS 15.5(2), reference here...but unfortunately I don't think the 4500-X latest version appears to go up to 15.5.

 

 

Content for Community-Ad