About pieters

Hey Shafi01, thanks for the quick reply. I don't think that is it because the change only becomes in effect after restarting the service (which I definately did). Since I locked myself out of CLI, you would think I indeed need console access but I did the following to revert the change: 1. export the running config as xml from GUI and delete the ssh section mentioned under <deviceconfig> <system> 2. import the modified config back into the fw and commit 3. login to the fw with a browser and go to /api 4. browse to   >  Operational Commands  >  set  >  ssh  >  service-restart  >  mgmt and click the submit button Step 1 and 2 can also be achieved through api by browsing to  >  Configuration Commands  >  devices  >  entry[@name='localhost.localdomain']  >  deviceconfig  >  system  >  ssh and then copy paste the restAPI url shown at the bottom but replace "action=get" with "action=delete" ... View more

I was able to remove weak ciphers but it is now impossible to SSH into the device at all. When looking at config audit in GUI I see this: <ssh> <ciphers> <mgmt> <aes256-ctr/> <aes256-gcm/> </mgmt> </ciphers> <default-hostkey> <mgmt> <key-type> <ECDSA>256</ECDSA> </key-type> </mgmt> </default-hostkey> <regenerate-hostkeys> <mgmt> <key-type> <ECDSA> <key-length>256</key-length> </ECDSA> </key-type> </mgmt> </regenerate-hostkeys> <session-rekey> <mgmt> <interval>3600</interval> </mgmt> </session-rekey> <mac> <mgmt> <hmac-sha2-256/> <hmac-sha2-512/> </mgmt> </mac> </ssh> Are you still able to use putty to connect to cli? Did you have to make changes in putty to be able to? ... View more