Weak cipher blocking in ACE20

Question

I tried to create a L7 class-map for blocking the clients with ciphes strength less than 128 in ACE20 running with Software version A2(2.3).
But there were no command inside the L7 class-map called cipher for matching the cipher strength 128. Command Tried to issue was
host1/Admin(config-cmap-http-lb)#match cipher less-than 128
So I want to know whether this is possible on ACE 20 and SW version A2(2.3).  Kindly suggest a way to acheive this.
I have seen some other configuration using the parameter-match, But I dont know the Cipher Names which to allow.  I want to drop all the connections with less than 128 bits cipher strength.
Can anyone help on this???
Tharun

Answer 1

By default all available ciphers will be allowed. Those are:
–RSA_EXPORT1024_WITH_DES_CBC_SHA
–RSA_EXPORT1024_WITH_RC4_56_MD5
–RSA_EXPORT1024_WITH_RC4_56_SHA
–RSA_EXPORT_WITH_DES40_CBC_SHA
–RSA_EXPORT_WITH_RC4_40_MD5
–RSA_WITH_3DES_EDE_CBC_SHA
–RSA_WITH_AES_128_CBC_SHA
–RSA_WITH_AES_256_CBC_SHA
–RSA_WITH_DES_CBC_SHA
–RSA_WITH_RC4_128_MD5
–RSA_WITH_RC4_128_SHA
To narrow that down, create a parameter-map that specifies only the strong ones. Then apply that PMAP using the ssl advanced-options keyword in your ssl-proxy service section. Something like this:
parameter-map type ssl _SSL_PMAP
  cipher RSA_WITH_RC4_128_MD5
  cipher RSA_WITH_RC4_128_SHA
  cipher RSA_WITH_3DES_EDE_CBC_SHA
  cipher RSA_WITH_AES_128_CBC_SHA
ssl-proxy service _SSL
  key
  cert
  chaingroup
  ssl advanced-options _SSL_PMAP