topic Re: How would you disable weak ciphers on a Zone Director 1200 in ZoneDirector

How would you disable weak ciphers on a Zone Director 1200

wingreg — Wed, 27 Aug 2025 13:22:52 GMT

Is there a way to disable weak cipher keys encryption on the Zone Director 1200 using version 10.5.0.0 build 190?

Security scan revealed there is weak cipher keys used.

Re: How would you disable weak ciphers on a Zone Director 1200

pranav — Thu, 28 Aug 2025 10:54:33 GMT

Hello Wingreg,

To disable the weak cipher key in the Zone director you can use the below command.

no support_tls1.0

To check the tls enabled on the Zone director use the below command.

ZD#debug

ruckus(debug)# show tls

Regards,
Pranav Anand | Senior Technical Support Engineer

Re: How would you disable weak ciphers on a Zone Director 1200

wingreg — Thu, 28 Aug 2025 12:02:02 GMT

Thank you I will disable that one

Re: How would you disable weak ciphers on a Zone Director 1200

pranav — Thu, 28 Aug 2025 13:05:40 GMT

Hello Wingreg,

Keep us posted if that works for you.

Regards,
Pranav Anand | Senior Technical Support Engineer

Re: How would you disable weak ciphers on a Zone Director 1200

ms264556 — Fri, 29 Aug 2025 21:10:14 GMT

If you use AI to generate forum comments then please check they are correct before posting.

ruckus(debug)# no support_tls1.0
The command is either unrecognized or incomplete. To view a list of commands that you can run from this context, type '?' or 'help'.

The correct command is support-tls, and you need to leave a space between this and the version number, so e.g.:-

ruckus> enable
ruckus# debug
You have all rights in this mode.
ruckus(debug)# no support-tls 1.0-1.1
Are you sure you want to change whether support TLSv1.0 and TLSv1.1, If yes, it will reboot ZoneDirector.[Y/n]

Re: How would you disable weak ciphers on a Zone Director 1200

ms264556 — Fri, 29 Aug 2025 21:31:48 GMT

Please see my reply to pranav for the correct syntax.

I want to comment though that although your security scan has identified a theoretical problem with your ciphers, there are several critical security vulnerabilities in your version of ZoneDirector with public exploit code available.

Ruckus silently fix many vulnerabilities, so even if there weren't a bunch of high risk CVEs for your version of ZoneDirector, your business really must keep up to date with ZoneDirector software updates. So unless this is purely a box-ticking exercise, I recommend scheduling an upgrade to 10.5.1 (GA Refresh 9), and then staying up to date with subsequent releases.

Do note that the latest releases have tightened security a lot, so if you have a firewall between your ZD and APs then you'll need to remove the passive FTP rules and put in some new rules to allow HTTPS. Since I already did this, and it's not well documented, I have a page here describing the firewall changes I made.