Blocking non-compliant SSH versionsandfailing certificate validationsare fundamental security measures:
Block sessions when certificate validation fails
"The SSH Proxy profile should block sessions that fail certificate validation to ensure that only trusted hosts are allowed." (Source: SSH Proxy Decryption Best Practices) Block connections using non-compliant SSH versions Older SSH versions may have vulnerabilities or lack modern encryption algorithms.
"To enforce stronger security, block SSH sessions that use older or deprecated versions of the SSH protocol that do not comply with your security posture." (Source: SSH Decryption and Best Practices) Together, these measuresminimize the risk of MITM attacksand secure SSH traffic.