AnyConnect new feature - DTLSv1.2

[robert.robinson.1]

With the release of v9.10.1, has anyone been able to get DTLSv1.2 working with AnyConnect sessions? (Our clients are v4.6.02074)

-If I don't specify dtlsv1.2, it will always establish the DTLS tunnel using dtlsv1.0.

-If I do specify dtlsv1.2 with the following config, the DTLS tunnel fails to establish with the message "%ASA-5-722043: Group <groupid> User <userid> IP <ipaddress> DTLS disabled: unable to negotiate cipher".   Removing the "ssl cipher dtlsv1" line makes no difference.

ssl server-version tlsv1.2 dtlsv1.2

ssl cipher default custom "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384"

ssl cipher dtlsv1 custom "AES256-SHA"

ssl cipher tlsv1.2 custom "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384"

ssl cipher dtlsv1.2 custom "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384"

ssl ecdh-group group20

ssl dh-group group24

[Rob Ingram]

@Amafsha1DTLS v1.2 was introduced in ASA v9.10, you will need to upgrade.

[Amafsha1]

Thank you

[Amafsha1]

is it possible to go from 9.8 directly to 9.12 in 1 upgrade?  

[Rob Ingram]

Hi,

Yes you can go from ASA 9.8 to 9.12 in one upgrade, reference here.

HTH

[Amafsha1]

Thank you sir, I can't believe I missed that.  does 9.12 support DTLSv1.2?

[Rob Ingram]

Yes, DTLS 1.2 is available in 9.12, reference here.

[Marvin Rhoads]

FYI Firepower 6.6 was just released. It now includes TLS 1.2 support for Remote Access VPN.

Reference:

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/relnotes/firepower-release-notes-660/features.html#id_111020

DTLS 1.2 in remote access VPN

You can now use Datagram Transport Layer Security (DTLS) 1.2 to encrypt RA VPN connections. Use FTD platform settings to specify the minimum TLS protocol version that the FTD device uses when acting as a, RA VPN server. If you want to specify DTLS 1.2, you must also choose TLS 1.2 as the minimum TLS version. New/modified screens: Devices > Platform Settings > add/edit Threat Defense policy > SSL > DTLS Version option

Supported platforms: FTD

[Marvin Rhoads]

s.schuler@sys-tec.info Sorry - my mistake. I was looking at an ASAv earlier.

The ASA5506-X hardware platform DOES NOT support DTLSv1.2. This is true even when running the latest release train (9.15)

Reference: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn63389/?rfs=iqvred

I doubt Cisco will ever fulfill this enhancement request bug since the platform is now end of sales.

[logolbq01]

You are right  The ASA5512-X   ASA5515-X   ASA5525-X ASA5535-X ASA5545-X   hardware platform support DTLSv1.2.