Is there a way to disable weak cipher keys encryption on the Zone Director 1200 using version 10.5.0.0 build 190?
Security scan revealed there is weak cipher keys used.
Hello Wingreg,
To disable the weak cipher key in the Zone director you can use the below command.
no support_tls1.0
To check the tls enabled on the Zone director use the below command.
ZD#debug
ruckus(debug)# show tls
Regards,Pranav Anand | Senior Technical Support Engineer
Thank you I will disable that one
Keep us posted if that works for you.
If you use AI to generate forum comments then please check they are correct before posting.
ruckus(debug)# no support_tls1.0The command is either unrecognized or incomplete. To view a list of commands that you can run from this context, type '?' or 'help'.
The correct command is support-tls, and you need to leave a space between this and the version number, so e.g.:-
ruckus> enableruckus# debugYou have all rights in this mode.ruckus(debug)# no support-tls 1.0-1.1Are you sure you want to change whether support TLSv1.0 and TLSv1.1, If yes, it will reboot ZoneDirector.[Y/n]
Please see my reply to pranav for the correct syntax.
I want to comment though that although your security scan has identified a theoretical problem with your ciphers, there are several critical security vulnerabilities in your version of ZoneDirector with public exploit code available.
Ruckus silently fix many vulnerabilities, so even if there weren't a bunch of high risk CVEs for your version of ZoneDirector, your business really must keep up to date with ZoneDirector software updates. So unless this is purely a box-ticking exercise, I recommend scheduling an upgrade to 10.5.1 (GA Refresh 9), and then staying up to date with subsequent releases.
Do note that the latest releases have tightened security a lot, so if you have a firewall between your ZD and APs then you'll need to remove the passive FTP rules and put in some new rules to allow HTTPS. Since I already did this, and it's not well documented, I have a page here describing the firewall changes I made.
