Hello
In our Clientbased - VPN with AnyConnect 4.3.02039 an ASA 5500-X Series with 9.4(3)12 we have to optimize the cipher suites.
Before we had the 3.x Client only supporting TLS 1.0.
Now we changed to TLS 1.2 only an tried to configure more secure ciphers.
- Looks like althoug we do DHE - Suites on top of the priority the negotiation will never choose this for TLS 1.2.
- Depending on the order or number of the configured ciphers (even if reconfigure change TLS 1 or 1.1 or default) the AnyConnect will present the ASA different numbers and different orders of posible Ciphers (between 8 an 37 !)
- Looks like DTLS only can choose AES256-SHA. But I can configure also Ciphers with DHE.
Problem 1 is that for security reason PFS is to choose, but will never be negoatiated.
In some cases the TLS 1.2 do negoatiation to "more secure" ciphers first and immediately do a renegotiating to poorer one.
Problem 2 is that after TLS tunnel is up, it will change to the DTLS tunnel. Same problem with PFS and only SHA.
Looks like something is really buggy.
Where can I find documentation or bug - list which ciphers really supported and the conditions and dependencies from the ordering or dependencies from the configuration of the other TLS (1.0 / 1.1 / or default )?
Is it correct tha i can never see the negoatiating of the DTLS ?
Thanks for help
Martin
