08-27-2017 12:04 PM - edited 03-12-2019 04:30 AM
Hi guys.
i'm trying to force router c891 webvpn to use TLS1.2 instead TLS1.0
using followin command:" ip https secure ciphersuite dhe-aes-cbc-sha2"
As per ip http secure ? help cipher above is using TLS1.2 but as far as client connected I can see from client anconnect cipher TLS1.0 in use.
Could somebody clarify what's wron?
Thank you.
08-27-2017 10:06 PM
Do you have an EC certificate (i.e., Elliptic Curve vs. the more common RSA) on your router?
I haven't done it yet with an IOS router but there isd a good writeup below for getting Anyconnect to use TLS 1.2 on an ASA. In the example, it was necessary to have an EC certificate installed and bound to the interface.
https://ltlnetworker.wordpress.com/2016/12/18/elliptic-curve-asa/
08-30-2017 06:10 PM
Thank you for reply.
not yet I don't have ECDSA certificate installed to router but if I'm not mistaked I can use regular RSA certificate with ciphersuite:
--------------
rsa-aes-cbc-sha2 -> Encryption type tls_rsa_with_aes_cbc_sha2 (TLS1.2 & Above) ciphersuite
or
rsa-aes-gcm-sha2 -> Encryption type tls_rsa_with_aes_gcm_sha2 (TLS1.2 & Above) ciphersuite
--------------
These ciphersuites require just RSA certificate to be installed. Is it correct?
unfortunately, whenever I tryed them client's anyconnect shows TLS1.0still in use.
08-30-2017 11:37 PM
Hi,
Tls1.2 is not yet available for webvpn/anyconnect. it has been added to the secure https server only via:
08-30-2017 11:58 PM - edited 08-31-2017 12:02 AM
Thanks for the link to that enhancement request.
If one is using an ASA (vs. IOS or IOS-XE), TLS 1.2 has been obesrved to work for AnyConnect when using next generation encryption.
Please refer to the following article:
https://ltlnetworker.wordpress.com/2016/12/18/elliptic-curve-asa/
He shows the following outcome from an AnyConnect client establishing a remote access VPN session:
Dec 17 2016 17:13:13: %ASA-7-725012: Device chooses cipher ECDHE-ECDSA-AES256-GCM-SHA384 for the SSL session with client outside:89.135.x.x/60831 to a.b.c.d/443
Dec 17 2016 17:13:13: %ASA-6-725016: Device selects trust-point DC1-EC-out for client outside:89.135.x.x/60831 to a.b.c.d/443
Dec 17 2016 17:13:14: %ASA-6-725002: Device completed SSL handshake with client outside:89.135.x.x/60831 to a.b.c.d/443 for TLSv1.2 session
08-30-2017 11:59 PM
That is for the ASA not the IOS.
Moh,
08-31-2017 12:00 AM
Yes - I was editing my reply when you posted. :)
09-04-2017 09:32 AM
i see. Thank you Moh.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide