ssl cipher

[M Mohammed]

on performing pen test we were advised to remove DES-CBC3-SHA 

looking at our asa config i can see 

ssl cipher default custom "AES128-SHA:AES256-SHA:DES-CBC3-SHA"
ssl cipher tlsv1 custom "AES128-SHA:AES256-SHA:DES-CBC3-SHA"
ssl cipher dtlsv1 custom "AES128-SHA:AES256-SHA:DES-CBC3-SHA"

if i remove the cipher DES-CBC3-SHA, will the anyconnect clients get disconnected?

note: none of the anyconnect clients are using DES-CBC3-SHA 

Please advise

many thanks

MM

[GioGonza · Accepted solution]

Hello @M Mohammed,

If nobody is using it, you can remove it safely. Either way, the ASA will try first AES128-SHA and after AES256-SHA so you shouldn´t have any problem. 

It won´t affect anything else, if you want to check first issue the command "show vpn-sessiondb detail anyconnect".

HTH

Gio

[M Mohammed]

Many thanks G, going to implement it tomorrow and will reply with the outcome.

MM