SHA1 deprecated setting for SSH on WLC 5520

[jiahaurnyon]

Dear Cisco Comunity Expert,

We have WLCs running on 8.5.182.7. During our cybersecurity team scanning vulnerability, we have the result on SHA1 deprecated setting for SSH. We have already put "config network ssh host-key use-device-certificate-key".  Through "show network summary", we can observe that the Secure Shell (ssh) Cipher-Option high has been "Enabled".

Please let us know how we can check/correct the SSH configuration in the configuration to fix this SHA1 deprecated setting for SSH.

[marce1000]

 - Upgrade to https://software.cisco.com/download/home/286284738/type/280926587/release/8.10.190.0   and check again , 

 M.

[suresh-manandhar]

AOS upgrade didn't resolve for me

[ammahend]

Did you run this ? If not run the command and check again. 

“config network ssh cipher-option high enable” command to enable sha2. 

[suresh-manandhar]

yes this is already there

[ammahend]

Sorry just saw you mentioned in original post, I don’t think there is a command to check the cipher-suite other than show network summary (to see it’s enabled). If you have upgraded and high-cipher is enabled ask them to audit again, and see how they are claiming use of sha1, make sure they are talking about ssh and not some other service like web, mic cert etc. 

[marce1000]

  @ammahend >...., I don’t think there is a command to check the cipher-suite other than ...
                               For your references :  %  nmap --script ssh2-enum-algos WLC5520-hostname 

  M.

[balaji.bandi]

As suggested to upgrade to latest version (make sure before upgrade to latest code, check the AP compatability before upgrade)

and follow below thread :

https://community.cisco.com/t5/wireless/wlc5520-8-10-185-tls1-2-using-insecure-ciphers-cbc-amp-sha/td-p/4869853

If the WLC inside network and there is no Guest network, some how you are ok, but since WLC 5520 getting end of Life, suggest to move to WLC cat 9800 for Long life.