Sweet32,3DES, SHA1,RC4, disable, using "RSA certificate" with SSL/TLS profile
Hello good evening, as always thank you very much for your support, please help me to clarify an issue related to weak encryption of TLS/SSL Web-gui using rsa certificate to disable 3DES, SHA1 and RC4, of an SSL/TLS profile for WEB-GUI access and continue negotiating only with strong algorithms.
This is the reference link:
With the following commands 3DES,SHA1 and RC4 are disabled:
That is explicit commands that disable 3des,sha1 and RC4 ( TLSprofileTest is an example of SSL/TLS profile):
set shared ssl-tls-service-profile TLSprofileTest protocol-settings enc-algo-3des no
set shared ssl-tls-service-profile TLSprofileTest protocol-settings auth-algo-sha1 no
set ssl-tls-service-profile TLSprofileTestprotocol-settings enc-algo-rc4 no
Now the question is the following, please answer as precisely as possible:
-When disabling the weak encryption and authentication algorithms with the "NO" option (previously detailed commands), is it necessary, should or is it required to explicitly set the strong algorithms as "YES"? or the firewall assumes, that by setting "NO" to the weak ones, the firewall will automatically negotiate with all other algorithms, except the ones that were declared as "NO" ( 3DES,SHA1 AND RC4 ).
I remain attentive, cordial greetings and attentive to your comments.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!