华为路由器中安全风险警告的解决

问题：

web管理端登录，提示

当前系统中存在弱加密算法，建议telnet或者CLI登录设备通过命令行display security risk查看并推荐使用安全的加密算法和协议。

控制台具体显示为

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

[Huawei]display security risk Risk level       : high Feature name     : SSH_SERVER Risk information : Insecure key exchange algorithm is enabled in SSH server. Repair action    : It is recommended to disable the insecure key exchange algorithm.   Risk level       : high Feature name     : SSL Risk information : Insecure cipher suite(rsa_aes128_sha256) is enabled in configuring a server-based SSL policy. Repair action    : It is recommended to disable the insecure cipher suite.   Risk level       : high Feature name     : SSL Risk information : Insecure cipher suite(rsa_aes256_sha256) is enabled in configuring a server-based SSL policy. Repair action    : It is recommended to disable the insecure cipher suite.   Risk level       : medium Feature name     : IPSEC Risk information : Insecure encryption-algorithm (aes-128) are enabled in IKE proposal. Repair action    : It is recommended to disable the insecure encryption-algorithms.   Risk level       : medium Feature name     : IPSEC Risk information : Insecure encryption-algorithm (aes-192) are enabled in IKE proposal. Repair action    : It is recommended to disable the insecure encryption-algorithms.   Risk level       : medium Feature name     : IPSEC Risk information : Insecure encryption-algorithm (aes-256) are enabled in IKE proposal. Repair action    : It is recommended to disable the insecure encryption-algorithms.

 

官方文档未给出具体操作。列一下个人的解决步骤：

原因出在默认配置中存在弱加密算法，存在安全隐患，具体修改时又层层策略引用嵌套，需要自上而下解决。

IPSEC相关风险出在ike的策略中：

?

1 2	ike proposal default encryption-algorithm aes-gcm-128 aes-gcm-256 sm4

　　

ssh服务器：

?

1	ssh server key-exchange dh_group14_sha256 dh_group15_sha512

　　

ssl的比较麻烦，最后查出来默认策略是被https服务使用，先解除https服务即可：

?

1 2 3 4 5 6

undo http secure-server enable undo http secure-server ssl-policy ssl policy default_policy ciphersuite ecdhe_rsa_aes128_gcm_sha256 ecdhe_rsa_aes256_gcm_sha384 http secure-server ssl-policy default_policy http secure-server enable

　　

最后再检查，确认告警清除，但是web页依然提示暂时忽略。