How to check if 3750 switch is using sslv3

[mahesh18]

Hi Everyone,

i an trying to https to 3750 switch using firefox below is error message

Firefox cannot guarantee the safety of your data on 10.0.0.4 because it uses SSLv3, a broken security protocol.
Advanced info: ssl_error_no_cypher_overlap
Learn More…

ip http secure-server ---- is configured on 3750.

i checked config on 3750 switch it does not show if sslv3 is enabled.

is there any command i can use to check ssl config on 3750 switch?

Regards

Mahesh

[Seb Rupik · Accepted solution]

Hi Mahesh,

Try running nmap against your switch: http://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html

nmap --script ssl-enum-ciphers -p 443 <switch_name>

There is an open Cisco bug for this vulnerabilty:

https://tools.cisco.com/bugsearch/bug/CSCur23656

...which implies that this vulnerabilty is not fixed in any version of IOS!? If you are concerned, use the CLI and drop the HTTP(S) access.

cheers,

Seb.

[mahesh18]

Hi Seb,

I never run nmap before so i have to ask few questions

To run nmap on switch can i do this  from my PC ?

Can it be gui bases or command prompt?

Do i need to download namp software first if yes from which website should i do this?

Regards

Mahesh

[Seb Rupik · Accepted solution]

Hi Mahesh,

you will need to run nmap from a PC. It is pretty standed *nix CLI tool, but they have released a GUI for it; zenmap:

http://nmap.org/zenmap/

...which offers all of the functionality and avoids the clunky command prompt if you're a windows users!

Please rate helpful posts.

cheers,

Seb.

[mahesh18]

Hi Seb,

I was able to download and run the nmap via gui version.

It's pretty good tool for network people to use.

Regards

MAhesh