Solved

Enforce encryption strength on Cisco ASA VPN

Posted on 2014-01-21
3
2,531 Views
Last Modified: 2014-02-19
Hello

My client has an ASA 5505 firewall using the classic VPN client software. Cisco are dropping support for this client so we want to move to Anyconnect Essentials client software and we will upgrade the ASA to the latest versions of the OS (asa914-k8.bin) and ASDM (asdm-715-100.bin).
We would like to enforce a key length of 256 bits AES and 2048 RSA and the ASA should drop connection requests not meeting these standards. Is it possible to enforce this using the software mentioned?

My understanding of encryption is not the best.

Many thanks,

Alasdair Barclay
0
Comment
Question by:Alasdairb
  • 2
3 Comments
 
LVL 12

Accepted Solution

by:
Henk van Achterberg earned 500 total points
ID: 39798062
you can set SSL settings for SSL VPN/ASDM. This is not for AnyConnect though:

http://epubbud_uploads.s3.amazonaws.com/13749785/MZ39X7RW/03fig02.jpg

http://www.epubbud.com/read.php?g=MZ39X7RW&tocp=10

ciscoasa(config)#ssl trust-point TEST-CA outside
ciscoasa(config)# webvpn
ciscoasa(config-webvpn)#ssl server-version tlsv1
ciscoasa(config-webvpn)#ssl encryption aes128-sha1 aes256-sha1 3des-sha1 des-sha1
0
 

Author Comment

by:Alasdairb
ID: 39800497
Hello Henk,

thanks for the links, I did not come across these. I guess the line then would be
ciscoasa(config-webvpn)#ssl encryption aes256-sha1

and leave out the other options. It will either negotiate the aes256-sha1 or it won't connect.

I hope to have a proper read of your lined document tomorrow and will report back.

Thanks.
0
 

Author Closing Comment

by:Alasdairb
ID: 39871158
Hello Henk,

sorry I've been away so long, many projects to pay with. It's not sorted yet, at least the enforcement, but at least the Anyconnect is working.

I'll award the points as you were the only person to help, and you gave me good reading tips I didn't find myself.

Thanks.

Alasdair
0

Featured Post

Register Today - IoT Current and Future Threats

Are you prepared to protect your organization from current and future IoT Threats?  Join our Wi-Fi expert in episode three of our webinar series for a look at the current state of Wi-Fi IoT and what may lie ahead. Register for our live webinar on April 20th at 9 am PDT!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
Many of the companies I’ve worked with have embraced cloud solutions due to their desire to “get out of the datacenter business.” The ability to achieve better security and availability, and the speed with which they are able to deploy, is far grea…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question