Hi Daureen,

If you run a packet capture on the interface you want to check offered cipher suites on you should be able to see the TLS handshake and the cipher suites being offered. SSH onto the SBC and run packet-trace local start M20:0 on the interface replacing M20:0 with whatever is appropriate. You then need to SFTP onto the SBC to retrieve pcap file where you should be able to see TLS handshake. You might need to leave the capture running for a while to capture the TLS handshake or prompt some kind of failover between SBC's like Antonio described to force the SBC to renegotiate a TLS handshake.

Regards,

David.

Hi Antonio,

I think your understanding is correct.

Hi Shilpi,

I’m just testing and validating my idea.

Of course, deploying a new SBC would quickly resolve this issue.

Thanks everyone for your assistance.

Hi Shilpi

it is exactly what I ment on my previous reply .

Thanks for the confirm

Antonio

Hello Daureen

depending from how many clients your customer have ( if are many probably more time is needed ) they can try to trace the TLS handshake , after make an HA switchover TLS is negotiated again and in that moment , when clients behave as client TLS actors , it is possible to check which ciphers are offering .

Unfortunately shell on the SBC does not support openssl or nmap commands , with that it would have been much faster to check remote supported ciphers .

Cheers

Antonio