diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group14-sha256
Tip
After upgrading your 9.1 appliance to a newer version, reconfigure your SSH client and SSH server cipher list to the high-security mode.
xxxx-cms9500 (config) # compliance apply standard ? <standard> fips FIPS (Federal Information Processing Standard) cc-ndcpp CC-NDcPP (Common Criteria Network Device Protection Profile) all All supported standards xxx-cms9500 (config) # compliance apply standard all ? <cr> cipher-level Specify a cipher list security level to apply xxx-cms9500 (config) # compliance apply standard all cipher-level ? <cipher-level> compliant-security Configure all security certified standards-compliant ciphers high-security [initial default] Configure only high security certified standards-compliant ciphers (no CBC) previous Reapply with the previously specified cipher security level (high-security if you just upgraded to 10.0) xxx-cms9500 (config) #
In compliant-security mode, only DH Group 14 is available.