AnyConnect VPN Client TLS Requirements and Future Cipher Support

[rhoisington3]

We currently use SSLLabs.com to scan for best practice TLS configurations.

Here is what I currently use and I get capped at B.

ASA Code: 9.8(2)28

TLS 1.2 enabled

Ciphers enabled: (Implemented in this order)

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_256_CBC_SHA - WEAK - Seems to be required for AnyConnect

TLS_RSA_WITH_AES_128_CBC_SHA - WEAK - Seems to be required for AnyConnect

Do we have any idea when TLS 1.3 will be supported along with AEAD cipher?.

[Karsten Iwen]

I'm not aware of any roadmap for TLS 1.3; I'm waiting myself. But you can already use AES-GCM. This is my SSL-config:

ssl server-version tlsv1.2
ssl cipher tlsv1.2 custom "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES256-SHA256"
ssl cipher dtlsv1 custom "DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA"
ssl dh-group group14