问题：
web管理端登录，提示
当前系统中存在弱加密算法，建议telnet或者CLI登录设备通过命令行display security risk查看并推荐使用安全的加密算法和协议。
控制台具体显示为
[Huawei]display security risk Risk level : high Feature name : SSH_SERVER Risk information : Insecure key exchange algorithm is enabled in SSH server. Repair action : It is recommended to disable the insecure key exchange algorithm.Risk level : high Feature name : SSL Risk information : Insecure cipher suite(rsa_aes128_sha256) is enabled in configuring a server-based SSL policy. Repair action : It is recommended to disable the insecure cipher suite.Risk level : high Feature name : SSL Risk information : Insecure cipher suite(rsa_aes256_sha256) is enabled in configuring a server-based SSL policy. Repair action : It is recommended to disable the insecure cipher suite.Risk level : medium Feature name : IPSEC Risk information : Insecure encryption-algorithm (aes-128) are enabled in IKE proposal. Repair action : It is recommended to disable the insecure encryption-algorithms.Risk level : medium Feature name : IPSEC Risk information : Insecure encryption-algorithm (aes-192) are enabled in IKE proposal. Repair action : It is recommended to disable the insecure encryption-algorithms.Risk level : medium Feature name : IPSEC Risk information : Insecure encryption-algorithm (aes-256) are enabled in IKE proposal. Repair action : It is recommended to disable the insecure encryption-algorithms.
官方文档未给出具体操作。列一下个人的解决步骤：
原因出在默认配置中存在弱加密算法，存在安全隐患，具体修改时又层层策略引用嵌套，需要自上而下解决。
IPSEC相关风险出在ike的策略中：
ike proposal default encryption-algorithm aes-gcm-128 aes-gcm-256 sm4
ssh服务器：
ssh server key-exchange dh_group14_sha256 dh_group15_sha512
ssl的比较麻烦，最后查出来默认策略是被https服务使用，先解除https服务即可：
undo http secure-server enable undo http secure-server ssl-policy ssl policy default_policy ciphersuite ecdhe_rsa_aes128_gcm_sha256 ecdhe_rsa_aes256_gcm_sha384 http secure-server ssl-policy default_policy http secure-server enable
最后再检查，确认告警清除，但是web页依然提示暂时忽略。
