i'm trying to force router c891 webvpn to use TLS1.2 instead TLS1.0
using followin command:" ip https secure ciphersuite dhe-aes-cbc-sha2"
As per ip http secure ? help cipher above is using TLS1.2 but as far as client connected I can see from client anconnect cipher TLS1.0 in use.
Could somebody clarify what's wron?
Do you have an EC certificate (i.e., Elliptic Curve vs. the more common RSA) on your router?
I haven't done it yet with an IOS router but there isd a good writeup below for getting Anyconnect to use TLS 1.2 on an ASA. In the example, it was necessary to have an EC certificate installed and bound to the interface.
Thank you for reply.
not yet I don't have ECDSA certificate installed to router but if I'm not mistaked I can use regular RSA certificate with ciphersuite:
rsa-aes-cbc-sha2 -> Encryption type tls_rsa_with_aes_cbc_sha2 (TLS1.2 & Above) ciphersuite
rsa-aes-gcm-sha2 -> Encryption type tls_rsa_with_aes_gcm_sha2 (TLS1.2 & Above) ciphersuite
These ciphersuites require just RSA certificate to be installed. Is it correct?
unfortunately, whenever I tryed them client's anyconnect shows TLS1.0still in use.
Tls1.2 is not yet available for webvpn/anyconnect. it has been added to the secure https server only via:
Thanks for the link to that enhancement request.
If one is using an ASA (vs. IOS or IOS-XE), TLS 1.2 has been obesrved to work for AnyConnect when using next generation encryption.
Please refer to the following article:
He shows the following outcome from an AnyConnect client establishing a remote access VPN session:
Dec 17 2016 17:13:13: %ASA-7-725012: Device chooses cipher ECDHE-ECDSA-AES256-GCM-SHA384 for the SSL session with client outside:89.135.x.x/60831 to a.b.c.d/443
Dec 17 2016 17:13:13: %ASA-6-725016: Device selects trust-point DC1-EC-out for client outside:89.135.x.x/60831 to a.b.c.d/443
Dec 17 2016 17:13:14: %ASA-6-725002: Device completed SSL handshake with client outside:89.135.x.x/60831 to a.b.c.d/443 for TLSv1.2 session