topic Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1? in ZoneDirector

Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

james_hicks_1ll — Mon, 12 Nov 2018 12:16:16 GMT

Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

Ankush_Chandan — Mon, 12 Nov 2018 15:11:48 GMT

Hi James,

TLSv1.0 is disabled in 10.1.1.0.55.
<From Release notes Text>
TLSv1.0 has been disabled in this release due to security concerns, and ZoneDirector now supports only TLSv1.1 and v1.2.

Regards,
-Ankush

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

robert_lee_joc5 — Fri, 15 Nov 2019 13:13:06 GMT

Our ZoneDirector 1200 on 10.3.0.0 build 398 but my nessus scan reports that it has the SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability (BEAST)

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

sanjay_kumar — Thu, 21 Nov 2019 03:49:16 GMT

Hi,

To understand the TLS version currently used, SSH into the AP and check the TLS version with the command "get tls-version". If the output is as below then the TLS version 1.0 is been used.

rkscli: get tls-version
Minimum TLS Version: tlsv1
OK

To disable tls 1.0 on the AP, set the tls to 1.1 or 1.2 with the below command.
rkscli:set tls-version tlsv1.2

To disable the tls version 1.0 on the Zone director, use the below command.

ruckus> en
ruckus# debug
You have all rights in this mode.
ruckus(debug)# no support-tls 1.0
Are you sure you want to change whether support TLSv1.0, If yes, it will reboot ZoneDirector.[Y/n]

Note: ZD will reboot.

Regards,
Sanjay Kumar

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

robert_lee_joc5 — Sun, 24 Jan 2021 14:02:56 GMT

@sanjay_kumar_gols5p74yq7mn

I have a zone director 1200.

get tls-version is not a recognized command.

I would like to turn off tlsv1.1 and only allow tlsv1.2, will this break the communication between the zone director and the ap's through ftp?

FYI, per NIST, effective June 2018, must cutover to tls 1.2 because tls 1.1 has multiple cryptographic flaws that can be exploited by a man-in-the-middle attack.

I followed your steps to disable tls 1.1 and verified it using openssl. It worked for 443 and shows only tls 1.2 is allowed but my nessus scan still shows that ftp is still using tls 1.1

Robert Lee

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

sanjay_kumar — Mon, 25 Jan 2021 00:27:09 GMT

Hi Robert,

"get tls-version" is a AP command.

After disabling the tls1.1, could you please get us the output of this command from AP?

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

robert_lee_joc5 — Mon, 25 Jan 2021 02:15:00 GMT

rkscli: get tls-version
Minimum TLS Version: tlsv1
OK

Allowed me to
openssl s_client -connect x.x.x.x:22 -tls1

openssl s_client -connect x.x.x.x:22 -tls1_1
openssl s_client -connect x.x.x.x:22 -tls1_2

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

robert_lee_joc5 — Mon, 25 Jan 2021 03:14:07 GMT

I was able to set tls-version tlsv1.2 on all my access points.

Thank you.

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

sanjay_kumar — Mon, 25 Jan 2021 03:20:26 GMT

Hi Robert,

Thanks for the update. The below output showed that the TLS was still set to TLS1.0.

rkscli: get tls-version
Minimum TLS Version: tlsv1

However, now I see that you are able to set it correctly.

Glad to hear that the issue is resolved.

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

jpums — Thu, 23 Feb 2023 15:06:24 GMT

Hi SanJay,

If we can change the TLS from 1.0 to 1.2 of AP, does it affect the smartzone?

Thank you.

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

ALI — Wed, 07 Feb 2024 10:21:08 GMT

I HAVE Controller: ZD 1200

Version : 10.2.1.0 build 183

CAN i disable TLS 1.0 or 1.1 with above procedures.

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

sanjay_kumar — Thu, 08 Feb 2024 06:21:34 GMT

Hi @ALI

Yes, you can use the same procedure to disable TLS 1.0 and 1.1 on the ZD

To check the version on the AP CLI:
rkscli: get tls-version
Minimum TLS Version: tlsv1
OK

To disable tls 1.0 on the AP, set the tls to 1.1 or 1.2 with the below command.
rkscli:set tls-version tlsv1.2

To disable the tls version 1.0 on the Zone director, use the below command.

ruckus> en
ruckus# debug
You have all rights in this mode.
ruckus(debug)# no support-tls 1.0
Are you sure you want to change whether support TLSv1.0, If yes, it will reboot ZoneDirector.[Y/n]

Note: ZD will reboot.

After the ZD reboot, use the command "no support-tls 1.1" to disable TLS 1.1

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

ALI — Thu, 08 Feb 2024 12:10:47 GMT

Hi Sanjay,

thank you for the response.

i will run the command and check back with you !!

Re: Is it possible to disable TLS 1.0 on the Zonedirector ZD1200 firmware version 10.1?

sanjay_kumar — Fri, 09 Feb 2024 03:06:11 GMT

Hi @ALI
Sure, let us know if you face any issues.