A hardening review of IOS XE devices finds that SSH version 1 is still accepted and weak algorithms are enabled for management sessions. Which change aligns with benchmark guidance?

SSH version 1 has known design weaknesses, and older key exchange, cipher and MAC algorithms are considered weak. Benchmark guidance for network devices is to accept only SSH version 2 for remote management and to restrict the negotiated algorithms to strong options, often alongside an adequate host key size, idle timeouts and limits on authentication retries. That ensures management sessions get modern confidentiality and integrity protections and prevents an attacker from forcing a downgrade to a weaker protocol. Allowing both versions while lengthening passwords leaves the version 1 weaknesses available to a downgrade attack; password strength does not fix protocol flaws. Telnet inside an IPsec tunnel adds complexity and still exposes cleartext credentials wherever the tunnel does not reach, and benchmarks direct administrators toward SSH rather than Telnet. Moving SSH version 1 to a nonstandard port is obscurity; scanners still find the service and the protocol remains weak. Exam caveat: restricting algorithms can break older management tools, so confirm client compatibility before enforcing the change. Operational check: confirm the device reports SSH version 2 only, then attempt a version 1 connection and a connection offering only a weak cipher from a test client, and verify both are refused.