华为路由器中安全风险告诫的解决
问题：web管理端登录，提示
当前体系中存在弱加密算法，建议telnet大概CLI登录设备通过命令行display security risk检察并推荐使用安全的加密算法和协议。
控制台具体显示为
display security risk
Risk level : high
Feature name : SSH_SERVER
Risk information : Insecure key exchange algorithm is enabled in SSH server.
Repair action : It is recommended to disable the insecure key exchange algorithm.
Risk level : high
Feature name : SSL
Risk information : Insecure cipher suite(rsa_aes128_sha256) is enabled in configuring a server-based SSL policy.
Repair action : It is recommended to disable the insecure cipher suite.
Risk level : high
Feature name : SSL
Risk information : Insecure cipher suite(rsa_aes256_sha256) is enabled in configuring a server-based SSL policy.
Repair action : It is recommended to disable the insecure cipher suite.
Risk level : medium
Feature name : IPSEC
Risk information : Insecure encryption-algorithm (aes-128) are enabled in IKE proposal.
Repair action : It is recommended to disable the insecure encryption-algorithms.
Risk level : medium
Feature name : IPSEC
Risk information : Insecure encryption-algorithm (aes-192) are enabled in IKE proposal.
Repair action : It is recommended to disable the insecure encryption-algorithms.
Risk level : medium
Feature name : IPSEC
Risk information : Insecure encryption-algorithm (aes-256) are enabled in IKE proposal.
Repair action : It is recommended to disable the insecure encryption-algorithms.
官方文档未给出具体操作。列一下个人的解决步骤：
原因出在默认配置中存在弱加密算法，存在安全隐患，具体修改时又层层计谋引用嵌套，需要自上而下解决。
IPSEC相关风险出在ike的计谋中：
ike proposal default
encryption-algorithm aes-gcm-128 aes-gcm-256 sm4
ssh服务器：
ssh server key-exchange dh_group14_sha256 dh_group15_sha512
ssl的比较麻烦，最后查出来默认计谋是被https服务使用，先排除https服务即可：
undo http secure-server enable
undo http secure-server ssl-policy
ssl policy default_policy
ciphersuite ecdhe_rsa_aes128_gcm_sha256 ecdhe_rsa_aes256_gcm_sha384
http secure-server ssl-policy default_policy
http secure-server enable
最后再检查，确认告警清除，但是web页依然提示临时忽略。
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。
页:
[1]