Disable SSL v2 and weak cipers on a RV325 for PCI compliance

How do you disable SSL v2 and weak cipers on a RV325 to become PCI compliant?

Hello
per Cisco RVS4000 product site information this router is already end of life since January 30, 2010. Last date of support is also already missed - April 30, 2013. This means that according Cisco policy no further updates to existing firmware will be done - neither security-related fixes. And I am afraid that this is fact with which you have to deal.
regarding RV320 - it seems that there is no any possibility to restrict SSL/TLS protocol/version by your own in current version. Francis - I would recommend you to open service request to Cisco SMB Support if you still have valid support contract. I hope there is good chance to get it fixed as this security related inability.
lastly - for all products (including RVS4000) - I would suggest to keep management interface of router separated most as possible - i.e. restrict access to management interface only to single subnet/host(s) only (via Firewall feature). With having administration/management subnet and certain client(s) which is a part of this subnet can help to avoid eavesdropping your connection to router. Of course disabling remote management is the best thing you can do in any case (including avoid of possible firmware bugs, loggin attempts and so on).

Similar Messages

  • HT1212 this doesnt wor someone help me! my sister disabled her ipod and im trying to fix it for her.

    my sister disabled her ipod and all it says on the screen when you turn it on is ipod is disabled try again in 22,088,882 minutes and there is no slider. when i plug it in to my macbook it says itunes cant connect with the ipod and to try again with the passcode . someone please help me.

    Restore, if iTunes will let you.  Everything except the password will be restored.  Connect via cable to the computer that you use for sync.  Be forewarned that it takes a long time.  From iTunes, select the iPad/iPod and then select the Summary tab.  Follow directions for Restore and be sure to say "yes" to the backup.  You will be warned that all data (apps, music, movies, etc.) will be erased but, as the Restore finishes, you will be asked if you wish the contents of the backup to be copied to the iPad/iPod.  Again, say "yes."
    At the end of the basic Restore, you will be asked if you wish to sync the iPad/iPod.  As before, say "yes."  Note that that sync selection will disappear and the Restore will end if you do not respond within a reasonable time.  If that happens, only the apps that are part of the IOS will appear on your device.  Corrective action is simple -  choose manual "Sync" from the bottom right of iTunes.
    If you're unable to do the Restore, go into Recovery Mode per the instructions here.

  • RV016 - SSL too weak Vulnerabilities on network due PCI Compliance

    DISABLE REMOTE MANAGEMENT AND HTTPS.................

    RV016 - SSL too weak  Vulnerabilities on net: work due PCI COMPLIANCE
    DISABLE REMOTE MANAGEMENT AND HTTPS..............

  • Disable the Copy and Paste option in keyboard [Textbox control] Windows phone App

    In Windows phone 8.1 WRT app, I want to disable the copy and paste option in the keyboard for the textbox control
    Please let me know if any possibilities and if you have the code snippets Please share it .

    Hi Ruthradevi,
    As I know we have no way to disable the copy and paste option in the keyboard.
    Why do you want to disable it, can you explain more about your scenario?  Let's see if we can make a similar function like you required.
    Regards,
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • R12 - Help for Disabling of Home and Preferences links

    Hi all,
    I am trying to disable the home and preferences link (the global links) for a OAF page. As per the suggestion provided in the below link, i have made changes to the code.
    [Thread: Hide 'Home Logout Preferences....' links in a OAF page.|http://forums.oracle.com/forums/thread.jspa?threadID=1097841&tstart=135]
    This works just fine when run from JDev. However, when ported to server and running the same, the global links still get displayed.
    After moving the Controller class to server, apache bounce was carried out.
    Help on this will be much appreciated.

    Sorted! Changed from WPA2 to WPA/WPA2 and everything is OK!

  • How do you disable SSL\ CBC Ciphers and Weak Algorythms in Windows Server 2003

    Hello, and please accept my humble thanks in advance.The problem that I'm having is the protocols listed below must be disabled on my Windows 2003 (IIS) Servers before we can pass a PCI audit. Now I've taken care of all of this on Windows 2008R2, but not
    without days and nights of searching the internet for information that is not only clear to understand but accurate, however, I'm not having much luck with 2003.
    Vulnerabilities:
    SSL Server Supports CBC Ciphers for SSLv3
    SSL Server Supports CBC Ciphers for TLSv1
    SSL Server Supports RC4 Ciphers for SSLv3
    SSL Server Supports RC4 Ciphers for TLSv1
    SSL Server Supports Weak MAC Algorithms for SSLv3
    SSL Server Supports Weak MAC Algorithms for TLSv1
    Here's what I've tried, I've done the registry edit as follows, it did not work;
    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL]
    "EventLogging"=dword:00000001
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
    "Enabled"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]
    "Enabled"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
    "Enabled"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
    "Enabled"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
    "Enabled"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168/168]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
    "Enabled"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
    "Enabled"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
    "Enabled"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
    Here's what I've tried, I've installed the Microsoft Security Bulletin MS12-006 - Important Vulnerability in SSL/TLS Could Allow Information Disclosure (2643584), it did not work for those issues but it did close the SSLv2.0 problem.
    Is there ANY reason why the registry edit would not work?
    Again, thank you.
    Don
    Also,
    Has anyone seen or used this Hotfix... what is it and how would it relate to this issue.
    An update is available to adds support for the TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA and the TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA AES cipher suites in Windows Server 2003
    http://support.microsoft.com/kb/948963

    Hi,
    Hope we could find helpful information in the below KB:
    How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll
    http://support.microsoft.com/kb/245030
    Please go through it.
    TechNet Subscriber Support
    If you are
    TechNet Subscription
    user and have any feedback on our support quality, please send your feedback
    here.
    Regards, Yan Li

  • SSL Enable and disable

    Hi Folks,
    There are couble of doubts about SSL  for ebs 12.1.1 and 11.1.0.7
    1. SSL enalbed at EBS : If we disable what will be impact and what will be consider at EBS side and DBA perspective
    2.SSL Disabled at EBS : if we enable , what will be impact and  what will be consider at EBS side and DBA perspective
    Thanks,

    APPSDUDE wrote:
    Hi Folks,
    There are couble of doubts about SSL  for ebs 12.1.1 and 11.1.0.7
    1. SSL enalbed at EBS : If we disable what will be impact and what will be consider at EBS side and DBA perspective
    2.SSL Disabled at EBS : if we enable , what will be impact and  what will be consider at EBS side and DBA perspective
    Thanks,
    Not sure if I understand your questions correctly, but you can find all details about enabling/disabling SSL for R12 (12.1.x) in the following docs.
    Enabling SSL in Oracle E-Business Suite Release 12 (Doc ID 376700.1)
    SSL Primer: Enabling SSL in Oracle E-Business Suite Release 12 (Trial Certificate Example) (Doc ID 1425103.1)
    Is There a Documented Process to Remove the SSL Configuration From an E-Business Suite Instance? (Doc ID 1264712.1)
    Thanks,
    Hussein

  • How to disable SSL v3 for sun os 5.6 (OAS 4.0.8), I am facing POODLE vulnerability issue?

    my Website is hosted on Sun OS 5.06 (OAS 4.0.8) and using web server : Oracle_Web_Listener/4.0.8. Website is configured to use https for secure pages and it was working fine from last 10 years but suddenly i am getting complaints from my customers that they can not browse site on chrome version 40 and above and firefox 34 and above.
    I searched for this issue and found that there is POODLE attack which may causing this issue. now the only solution i can see is to disable SSL v3 on server.
    Can any help me out with the process or an idea, How to disable SSL V3 on this Olde server? its sun microsystem server.

    Hi Aamir,
       This is old software, been a while since I saw one of these.
        Normally when SSL was setup there were two listeners, one with SSL and one without, in a different port, so you could try to find this second port, which may work without any need to change the configuration.
        Else, try to check on the OAS manager (Usually on port 8888), the HTTP listener -> WWW -> Network, if there is a setup only for the SSL port, you will need to add a new line, with the same configuration, but a different port and the security disabled.
        Also, there may be some setting on the application itself for the url path. If so, when you navigate in the application it will try to redirect you back to the SSL port. In that case you will need to figure out where to change that, which depend on the application itself.
       Found this page on google with the process to setup SSL on OAS 4.0, you need to do the inverse of step 5.
    WoSign Support: SSL Certificates Installation Instruction - Oracle Web Server (OAS 4.0.8)
    Regards,
    Luis

  • Disable SSL 2.0 on Windows 2008 R2

    Hi.
    Can anyone give me a step by step on how to disable SSL 2.0 on IIS 7.5 please? I cannot find an article for it and those refering to IIS 7.0 do not seem to work.
    Regards,
    Morris
    Best Regards, Morris Fury AFRIDATA.net

    Morris -
    Client-side SSL 2.0 is disabled by default on Windows 7 and Windows Server 2008 R2, which means that, when initiating an SSL connection from either of those two OSes that SSL 2.0 will not be sent as a supported protocol that the server can use. You can see
    this in the following registry value:
    Key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client
    Value: DisabledByDefault
    Server-side SSL 2.0 is not, however, disabled by default. This means that some other client, when initiating an SSL connection
    to Windows Server 2008 R2 can include SSL 2.0 in the list of supported protocols. If SSL 2.0 is the only protocol in common between the client and the server, the server will select it.
    Functionally, there is not much difference between setting Enabled to 0 and setting DisabledByDefault to 1.
    Hope this helps,
    Jonathan Stephens
    This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can
    be beneficial to other community members reading the thread.

  • Disabling SSL in Aqualogic Service Registry

    Hi All,
    i have installed and deployed Aqualogic Service Registry (ALSR) on weblogic server 9.2. However, by default, SSL is enabled during installation. I tried disabling SSL using Weblogic Admin Console but that didn't help. Is there a way i can configure ALSR war to disable SSL?
    --Vivek                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

    Hi James,
    As I am using ALSR and not OSR and also, deploying it on weblogic server (since, ALSR doesn't support oc4j server), I don't understand why i need to put this question in SOA suite forum.
    Installation of ALSR creates registry.war that eventually gets deployed on weblogic server. ALSR doesn't allow me to choose SSL enabling, it choses it by default which is not the case in OSR.
    --Vivek                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

  • Disable SSL 3.0 in DSEE 7

    Hello,
    Is there a way to disable SSL 3.0 in DSEE 7, such that only TLS 1.0/1.1/1.2 can be used?  I Googled for this and found MOS document 1950334.1, but the instructions in the document only apply to a DS proxy server.
    Thanks,
    Dave

    Disabling SSLv3 by changing the encryption settings but it did not actually work.  I loaded the LDIF and restarted the instance, and LDAP indicated that the change took effect:
    root@ldap-test:/# ldapsearch -D "cn=Directory Manager" -w xxxxxxxx -b "cn=config" -s sub '(cn=encryption)'
    version: 1
    dn: cn=encryption,cn=config
    objectClass: top
    objectClass: nsEncryptionConfig
    cn: encryption
    nsSSLSessionTimeout: 0
    nsSSLClientAuth: allowed
    nsSSLServerAuth: cert
    nsSSL2: off
    nsKeyfile: alias/slapd-key3.db
    nsCertfile: alias/slapd-cert8.db
    nsSSL3Ciphers: all
    nsSSL3: off
    However, a test with openssl with the "-ssl3" option (forcing it to only use SSLv3) still connected:
    $ /usr/local/openssl-1.0.1k/bin/openssl s_client -connect ldap-test.our-domain.edu:636 -ssl3
    CONNECTED(00000003)
    ... <showed our server certificate, etc.> ...
    If SSLv3 were actually disabled, that openssl test would have failed with an error. Disabling SSLv3 is required by our auditing tool because of the POODLE vulnerability, and a system cannot pass our audit unless SSLv2 and SSLv3 are disabled completely, but TLS 1.0/1.1/1.2 are still available.

  • Disable ssl

    Every couple of days, mail 6.2 re-enables ssl, and this causes mail to fail.  My anti-virus requires ssl to be disabled and it handles the ssl issue in order to scan inside of messages.  However, every day of so, the system or Mail 6.2 re-enables SSL and mail stops working.  Any suggestions ?

    My boss's new iphone 5 is truning the ssl switch on nightly, which causes her pop account to fail. I am attempting to set her phone up so that our POP provider will accept her via ssl connection.
    My question is  this - is there no way I can turn ssl off and have the switch left off? I understand that icloud mail requires it - but surely since its 2 accounts I can turn ssl on for one account and not the other?
    She is running the latest version IOS, phone has been in use for 3 days so I dount it has any corruption issues and its on the Sprint network. We pop our corporate mail, do not use any exchange services.
    TIA

  • Apple Mail 8.2 disables SSL to POP3 server (Securityrisk)

    Hi,
    Setup
    Computer:
    OSX 10.10.2
    Mail 8.2 (2070.6)
    Mail server A
    POP3 port 995 SSL
    (Non SSL - port 110 -  is disabled due to security reasons)
    Mail server B
    POP3 port 110
    POP3 port 995 SSL
    Summary
    OSX Mail client removes SSL support on non regular intervals for POP3 connections. For the connections that support regular non SSL POP3 (port 110) this reduces the security, but the mail is available. This was noticed by me because one ISP has locked down their POP3 server to SSL only due to security reasons. After reenabling SSL on the connection (Mail -> Preferences -> Accounts -> Account in question -> Advanced) the connection remains with SSL support for a while, then it is removed again. As OS X Mail has no token to identify SSL or regular port 110 connection this is transparant to the user, unless the server does not support regular POP3, at which time a error is generated.
    Comments
    1) This seems to be a security related issue with mail where OS X mail downgrades from SSL connection to regular port 110 POP3 traffic
    2) If corrected the connection is downgraded again within a couple of days, if not sooner.
    3) Connections to POP3 servers supporting port 110 are "unaffected" with the exception of the security issue of a downgrade
    4) Connections to POP3 servers that only support SSL - port 995 - are not able to complete until SSL has been reenabled manualy.
    5) Downgrade bug has been seen only on my machine, so it might not be something mainstream. Machine is updated to latest patches.
    Questions
    1) As this has only been observed on my machine, has anybody else seen this POP3 SSL downgrade bug?

    Same problem. The following information is from Symantec:
    To disable SSL\TLS
    Open Apple Mail.
    Click the Mail menu and select Preferences.
    Select your mail account on the left under Accounts, then click the Advanced tab.
    Confirm the check box labeled "use SSL" is not checked next to ports. If necessary remove the checkmark.
    Click the Account Information tab and select Edit Server list from the drop down next to Outgoing Mail Server.
    Click the Advanced tab and confirm there is not a checkmark next to Use Secure Socket Layer(SSL).
    Click OK and close the accounts. Window and choose to save.
    Click Save to update your settings.
    Restart Apple Mail.
    This does work for a while but eventually Mail reverts to enabling Use SSL and disabling Allow Insecure Authentication but only one some of my addresses but not all. Some accounts POP logs-in but not SMTP.

  • RDS 2012 issues after disabling SSL 3.0

    Hi all, we have Server 2012 R2 RDS infrastructure. I have 2 servers running RD web, gateway, and conn broker using Windows network load balancing. 3 RDSH servers behind them handling user workload.
    Last night I disabled SSL 3.0 on both of these servers using the registry key 'Enabled' set to zero in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server. Servers were rebooted after this change.
    I did not disable SSL 3.0 on the RDSH servers yet, but I don't think it matters in this situation because the SSL traffic only passes between the remote computer and the RDGW server, AFAIK.
    Today all the remote users were having issues with remote desktop sessions disconnecting them, but they would reconnect after a short time. They all told me this is unusual, normally the connections are quite stable. After I turned SSL 3.0 back on and rebooted,
    no more issues, users are happy. Has anyone else experienced this? Is there anything that can be done to stabilize connections while SSL 3.0 is disabled?

    Hi,
    Thank you for posting in Windows Server Forum.
    Did they receive any precise error when SSL3 is disabled?
    What’s your client OS and RDP version using for your network?
    If you would like to continue with SSL3 disabled you may try to change the RDP Security Layer under Security Layer. 
    When you are using RD Security Layer you are susceptible to MITM attack because there is no Server Authentication. I suggest you re-enable TLS 1.0 and have a ssl certificate from a public authority set on your RDP-Tcp listener.   
    You can also refer this article for other information.
    Hope it helps!
    Thanks.
    Dharmesh Solanki
    TechNet Community Support

  • ILOM, how to disable SSL v2?

    Hello
    Is there any possibility to disable SSL v2?
    I want to use HTTPS to connect to the server (Java Console) but it have to use SSL v3 only. Once trying to connect with v2 of SSL connection should not be established.
    Is there any possibility to do this?
    SP Firmware Version is: 3.0.3.20.e
    SP Filesystem Version 0.1.22
    Edited by: Luceks on Sep 2, 2009 4:28 AM

    Hi.
    You should have a SSL section under:
    1) Log in to the ILOM-SP WEB interface.
    2) Click --> Management --> SSL (or similar...)
    3)
    The SSL page appears. There're some sections to the SSL page.
    One section includes targets and properties and you can configure the SSL settings displayed
    in this section page (example):
    **SSL**
    State = Enabled | Disabled
    Roles = Administrator | Operator | Advanced | (none)
    Address = 0.0.0.0
    Port = 0
    4) Save settings page, to save any changes made to this section.
    s.

Maybe you are looking for