How to disable weak SSH chipper and CBC on the ICX switches

[Chandini]

Here the switch model used is 7150 series and firmware running are 8095c.

Run “show ip ssh config” to view all SSH details.

Device#show ip ssh config

SSH server                 : Enabled

SSH port                   : tcp\22

Host Key                   : RSA 2048

Encryption                 : aes256-cbc, aes192-cbc, aes128-cbc, aes256-ctr, aes192-ctr, aes128-ctr, 3des-cbc

Permit empty password      : No

Authentication methods     : Password, Public-key, Interactive

Authentication retries     : 3

Login timeout (seconds)    : 120

Idle timeout (minutes)     : 5

SCP                        : Enabled

SSH IPv4 clients           : All

SSH IPv6 clients           : All

SSH IPv4 access-group      :

SSH IPv6 access-group      :

SSH Client Keys            :

Client Rekey               : 0 Minute, 0 KB

Server Rekey               : 0 Minute, 0 KB

To disable weak SSH cipher:

The diffie-hellman-group1-sha1 key exchange method is a weaker algorithm and can be disabled using the “no ip ssh key-exchange-method dh-group1-sha1” command.

Command:

• Device(config)#no ip ssh key-exchange-method dh-group1-sha1

To disable CBC encryption mode:

Command:

• Device(config)# ip ssh encryption disable-aes-cbc

Output after disabling CBC encryption mode:

ICX7150-24F Switch(config)#show ip ssh config

SSH server                 : Enabled

SSH port                   : tcp\22

Host Key                   : RSA 2048

Encryption                 : aes256-ctr, aes192-ctr, aes128-ctr

Permit empty password      : No

Authentication methods     : Password, Public-key, Interactive

Authentication retries     : 3

Login timeout (seconds)    : 120

Idle timeout (minutes)     : 5

SCP                        : Enabled

SSH IPv4 clients           : All

SSH IPv6 clients           : All

SSH IPv4 access-group      :

SSH IPv6 access-group      :

SSH Client Keys            :

Client Rekey               : 0 Minute, 0 KB

Server Rekey               : 0 Minute, 0 KB

Reference links below:

Enabling SSH

• https://docs.commscope.com/bundle/fastiron-09010-securityguide/page/GUID-8AAB14D8-A662-493A-8504-F74...

Viewing SSH

• https://docs.commscope.com/bundle/fastiron-09010-securityguide/page/GUID-CA1D6AD1-861E-49B3-8CC3-2C1...

Disabling telnet Access

• https://docs.commscope.com/bundle/fastiron-08030-securityguide/page/GUID-0352E51C-3BF4-4F44-9853-466...

Disable CBC

• https://docs.commscope.com/bundle/fastiron-08030-adminguide/page/GUID-FFF3988D-6510-4D9E-B134-D484DB...

Disable weak SSH cipher:

• https://docs.commscope.com/bundle/fastiron-08090-securityguide/page/GUID-E6D5CCBB-B8BA-4818-B589-8FA...