We performed vulnerability scan on our C2960X switches and found the following message:
Checks the supported MAC algorithms (client-to-server and
server-to-client) of the remote SSH server.
Currently weak MAC algorithms are defined as the following:
- MD5 based algorithms
- 96-bit based algorithms
- none algorithm
We saw that the output of MAC Algorithms in "show ip ssh" is hmac-sha1, hmac-sha1-96.
Is there firmware versions that support hmac-sha2 for C2960X switch? If not, should we remove hmac-sha1-96 from the list of MAC algorithms by the command "ip ssh server algorithm mac hmac-sha1"? Our current firmware version is 15.0(2a)EX5, model is WS-C2960X-24TS-L.
