I have some network issues in my network due to misconfiguration of Cisco router and switches. Please give me some advice or solutions to fix these vulnerabilities and configuration issues.

  1. Vulnerability Name: SSH CBC Mode Ciphers Enabled
    Description: CBC Mode Ciphers are enabled on the SSH Server
    Solution: Disable CBC Mode Ciphers and use CTR Mode Ciphers

  2. Vulnerability Name: SSH Insecure HMAC Algorithms Enabled
    Description: Insecure HMAC Algorithms are enabled
    Solution: Disable any 96-bit HMAC Algorithms, Disable any MD5-based HMAC Algorithms.

  • What version of IOS are you running? – NULLZ Aug 27 '13 at 8:36


There is no way to enforce this on a Cisco router. The only thing you can do to harden your setup is to at least disable SSHv1 by running:

#ip ssh version 2

However this will still not disable CBC and 96-bit HMAC/MD5 algorithms. Cisco does not offer capabilities to fine tune your SSH server so deeply. The only thing you can do is force the a connection towards the server which does not use any of the above mentioned algorithms. Note that the client needs to do this and that it can't be forced to the client by the server.

Here you can see what options the SSH client on a Cisco router has available to initiate an SSH connection:

ssh [-v {1 | 2} |-c {aes128-ctr |aes192-ctr|aes256-ctr |aes128-cbc | 3des-cbc | aes192-cbc | aes256-cbc} |-l user-id | -l user-id:vrf-name number ip-address ip-address | -l user-id:rotary number ip-address | -m {hmac-md5 | hmac-md5-96 | hmac-sha1 | hmac-sha1-96} | -o numberofpasswordprompts n | -p port-num] {ip-addr | hostname} [command | -vrf] 
| improve this answer | |

A feature request to add the functionality seems to have been resolved in recent IOS releases, adding the functionality.

On (very) recent IOS versions (possibly restricted to certain trains, the documentation is extremely sparse), you should be able to:

> enable
# configure terminal
(config)# ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
(config)# ip ssh server algorithm mac hmac-sha1

You might want to check with "?" if better options have since become available, especially from the MACs before using my list as-is...

Not directly related, but you likely also want this in the config:

(config)# ip ssh version 2

ip ssh server algorithm hostkey also exists and seems to be equivalent to OpenSSH's PubkeyAcceptedKeyTypes option.

SSH Configuration guide (The commands aren't in the master command list yet, interestingly enough...)

| improve this answer | |
  • 1
    It took them 2 years? wow :/ – Lucas Kauffman Jan 14 '16 at 7:15
  • @LucasKauffman: And it seems like it was resolved in the last week.. – Gert van den Berg Jan 14 '16 at 7:32

You might need to upgrade your IOS tot he latest version and check the IOS support for strong cipher suites.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.