SSL Ciphers

[wynneitmgr]

Is there any good documentation on changing/configuring the SSL ciphers on an ASA 5508 using ASDM? We are having issues with our Cisco AnyConnect connecting to our VPN on phones and tablets. It works fine on PCs. Cisco TAC recommended changing the SSL ciphers on the ASA.

Thank you for any help!!

[balaji.bandi]

Look  at the ASa hardening guide :

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/200150-Cisco-Guide-to-Harden-Cisco-ASA-Firewall.html

[wynneitmgr]

@balaji.bandi 

Thanks for your reply! Here is what Cisco TAC told me I should do, I just don't know how to do it.

ssl server-version tlsv1.2

ssl cipher tlsv1.2 custom "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256"

ssl cipher dtlsv1 custom "DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA"

ssl dh-group group14

ssl ecdh-group group19

Here are my SSL Settings in ASDM:

[Rob Ingram · Accepted solution]

Hi @wynneitmgr 

Be careful before you make those changes, make sure you take a backup before you do anything.

It looks like TAC has provided the exact commands for you to copy and paste via the CLI. If you login to the ASA using SSH you should just be able to paste the commands. Else if you want to do via ASDM, just modify TLS.12, change to custom and paste the ciphers is quote marks "". From the Diffe-Helleman group drop-down list select group14. Make sure you apply and save afterwards.

[wynneitmgr]

@Rob Ingram 

Thanks Rob! Will I need to reboot the Firewall after making the changes. Will this affect any connected users? Just trying to think if I should do this after hours or not. Thanks again.

[Rob Ingram]

No you don't need to reboot the firewall after makes these changes. I don't believe the changes should not affect existing sessions, they will take affect for new sessions once the settings have been applied.

If I was you I'd test post-change with all devices just make sure they still work, as you probably know each type of device does not necessarily behave the same as another.

[wynneitmgr]

@Rob Ingram 

How do I backup the ASA in ASDM before I make the changes? Thanks for your help, I appreciate it.

[Rob Ingram · Accepted solution]

Here are a couple of examples:-

https://community.cisco.com/t5/security-documents/how-to-backup-asa-configuration-through-asdm/ta-p/3155782

https://www.pei.com/take-restore-asdm-backups-asas/

[wynneitmgr]

@Rob Ingram 

Thanks! I did figure it out. The Help feature has a lot of information in ASDM.