cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
425
Views
0
Helpful
2
Replies
SATORU SAEGUSA
Beginner

Impact of Mandatorily Using ATS Feature on Cisco ASA AnyConnect

Hi, all
Apple will make ATS feature mandatory from the end of 2016 and published requirements for connecting using ATS.

https://developer.apple.com/library/content/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW57

Is the AnyConnect for iPhone App affected by the requirements?
Current ssl cipher tlsv1.2 configuration of the ASA 9.6(2) does not contain ciphers presented by the requirements.

Thank you for your cooperation in advance.

2 REPLIES 2
Marvin Rhoads
VIP Community Legend

You can restrict the ASA to using strong ciphers using something like the following:

ssl cipher default custom "ECDHE-ECDSA-AES256-SHA384;AES256-SHA"
ssl cipher tlsv1 custom "ECDHE-ECDSA-AES256-SHA384;AES256-SHA"
ssl cipher dtlsv1 custom "ECDHE-ECDSA-AES256-SHA384;AES256-SHA"

The exact syntax may vary according to your ASA but the one I'm showing is running 9.6(2). I pointed the Qualys SSL checker at it and verify I can negotiate "TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048)".

I believe you need to sign your CSR using an ECDSA key to get the full ECDHE-ECDSA support. Please see the following two articles:

https://supportforums.cisco.com/document/12929911/creating-sha-2-certificate-signing-request-using-ecdsa

https://supportforums.cisco.com/document/12943436/understanding-and-configuring-asa-ec-certificate-and-ec-ciphers

Hi Rhoads,

Thank you for your useful reply.
AnyConnect 4.0.x for Apple iOS has been established connection to ASA that does not satisfy the security requirements at present.
I have surmised that the forcing does not affect AnyConnect app.

Create
Recognize Your Peers
Content for Community-Ad