In this section:
Use the TLS Profile window to create and configure profiles for implementing the Transport Layer Security (TLS) protocol for use with SIP over TLS. TLS is an IETF protocol for securing communications across an untrusted network. Normally, SIP packets travel in plain text over TCP or UDP connections; Secure SIP is a security measure that uses TLS, the successor to the Secure Sockets Layer (SSL) protocol. To add TLS policy to the SBC you configure a TLS profile. The TLS profile is assigned to the SIP signaling port and controls behavior of all TLS connections established on that signaling port. An instance of a TLS profile called defaultTlsProfile is present by default, and is used by default by each SIP signaling port; however, additional TLS profile instances may be created and used instead. The settings within the defaultTlsProfile may be modified. Also, you must set the supported transport protocols for the SIP signaling port to allow SIP over TLS over TCP. If a zone's Example: When On the SBC main screen, go to Configuration > System Provisioning > Security Configuration > TLS Profile. To create a new TLS Profile: Click New TLS Profile. Use the following table to configure the options and then click Save. Parameter Description Name The name assigned to this Transport Layer Security (TLS) profile. Must be 1 - 23 characters. For further details, refer to SBC Provisioning Limits App Auth Timer Specifies the higher layer authentication timer in seconds. Must be 1-60 seconds. The default value is 5. Handshake Specifies the time in which the TLS handshake must be completed. The timer starts when the TCP connection is established. Must be 1 - 60 seconds; default is 5. Session Resume Specifies the TLS session resumption period for which cached sessions are retained (in seconds). TLS allows successive connections to be created within one TLS session and the resumption of a session after a TLS connection is closed or after a server card failover, without repeating the entire authentication and other setup steps for each connection, except when the space must be reclaimed for a new session. Must be 0 - 86,400 seconds; default is 3600. Use this parameter to specify the first TLS Cipher Suite choice for this profile. (See Supported TLS/DTLS Crypto Suites table below for the list of cipher suites) Use this parameter to specify the second TLS Cipher Suite choice for this profile. (See Supported TLS/DTLS Crypto Suites table below for the list of cipher suites) Use this parameter to specify the third TLS Cipher Suite choice for this profile. (See Supported TLS/DTLS Crypto Suites table below for the list of cipher suites) Allowed Roles Specifies which role the SBC will act in for this TLS profile: Auth Client Indicates whether or not a TLS client is forced to authenticate itself within TLS. Client Cert Specifies the name of the default Client Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. Must be 1-23 characters or none. Server Cert Specifies the name of the Server Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. Must be 1-23 characters or none. Use this parameter to specify if certificate chain validation errors are acceptable while validating the peer certificate. TLS protocol version 1.0. TLS protocol version 1.1. TLS protocol version 1.2. TLS protocol version 1.3. Enabling V1_3 requires at least one TLS V1.3 cipher suite, even when v1_3 is enabled in addition to v1_2 or a lower TLS protocol version. If enabled, SBC will not insert empty fragments while sending packets on TLS over TCP connection. The options are: If enabled, the SBC verifies the value of the parameter Specifies the type of TLS hash function allowed for TLS sessions governed by the specified TLS profile. The options are: This flag indicates whether or not the received peer server certificates are validated. When set to False, unknown peer Root-CA/self-signed certificates are accepted without any validation. Modified: for 12.1.2 To edit a TLS Profile: To copy a TLS Profile and make any minor changes: To delete a TLS Profile: Supported TLS/DTLS Crypto Suites Authentication Mechanism Confidentiality Cipher and Mode Integrity Cipher RSA-WITH-NULL-SHA The integrity cipher used for the TLS Record protocol. RSA-WITH-AES-128-CBC-SHA (default) Confidentiality cipher and mode for the TLS Record protocol. AES-128-CBC SHA-1 RSA-WITH-AES-128-CBC-SHA-256 Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function. RSA-WITH-AES-256-CBC-SHA Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption. RSA AES-256-CBC SHA-1 RSA-WITH-AES-256-CBC-SHA-256* Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function. RSA AES-256-CBC SHA-256 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384** Confidentiality cipher and mode for the TLS Record with AES256 CBC and SHA384 as the hash function. Note: The SBC 11.1 and later versions do not support ECDH-ECDSA AES-256-CBC SHA-384 TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384** Confidentiality cipher and mode for the TLS Record with AES256 GCM and SHA384 as the hash function. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as the hash function. TLS_ECDHE-RSA-WITH-AES-256-CBC-SHA-384* Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 CBC and SHA384 as the hash function. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function. TLS_ECDHE-RSA-WITH-AES-256-GCM-SHA-384* Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function. TLS_RSA_WITH_AES_128_GCM_SHA256 Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function. TLS_RSA_WITH_AES_256_GCM_SHA384 Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function. TLS_AES_128_GCM_SHA256*** Confidentiality cipher and mode for the TLS Record with AES128 GCM and SHA256 as the hash function. TLS_AES_256_GCM_SHA384*** Confidentiality cipher and mode for the TLS Record with AES256 GCM and SHA384 as the hash function. TLS_CHACHA20_POLY1305_SHA256*** Confidentiality cipher and mode for the TLS Record with ChaCha20-Poly1305 and SHA256 as the hash function. * To use this cipher, enable TLS version 1.2 in the TLS Profile. ** To use this cipher, enable TLS version 1.2 in the TLS Profile and create SSL certificates using ECC keys. *** To use this cipher, enable TLS version 1.3 in the TLS Profile. TLS 1.3 does not support RSA. Certificates generated with RSA will not work with TLS 1.3. When the FIPS-140-3 mode is enabled, you cannot use the algorithms whose key exchange method is RSA, including: The SBC 7.2.x release supports FIPS-140-2 and the 10.1.3 release supports FIPS-140-3. FIPS-140-2 is not supported in 10.1.3 and later releases and gets automatically converted to FIPS-140-3 as part of the upgrade. To verify the current status of FIPS certification, contact the Global Support Assistance Center:sipSigPort
is configured for transportProtocolsAllowed
= sip-tls-tcp
, the SBC increments the configured portNumber
by 1 and uses it as the new port number for SIP over TLS signaling. The SBC then opens a TCP socket for SIP over TLS for the new TCP port number.sipSigPort
is configured with a portNumber
of 5060 and transportProtocolsAllowed
= sip-tls-tcp
, the SBC listens on TCP port 5061 for SIP over TLS.To View TLS Profiles
To Create a TLS Profile
Timer
TimerCipher Suite1 Cipher Suite2 Cipher Suite3
Name
NameAcceptable Cert Validation Errors Ocsp Profile Name Specifies the name of OCSP profile object referenced by TLS profile. V1_0 V1_1 V1_2 V1_3 Suppress Empty Fragments Peer Name Verify TLS Peer Name
. For details on TLS Peer Name, refer to Trunk Group - SIP Trunk Group.Hash Type Peer Cert Validate To Edit a TLS Profile
To Copy a TLS Profile
To Delete a TLS Profile
Public/Private Key Pair RSA NULL SHA-1 RSA RSA AES-128-CBC SHA-256 tls_ecdh_ecdsa_with_aes_256_cbc_sha384
. You must replace it with a valid Cipher before upgrading the SBC.ECDH-ECDSA AES-256-GCM SHA-384 ECDHE-RSA AES-128-CBC SHA-1 ECDHE-RSA AES-256-CBC SHA-384 ECDHE-RSA AES-128-GCM SHA-256 ECDHE-RSA AES-256-GCM SHA-384 RSA AES_128_GCM SHA-256 RSA AES_256_GCM SHA-384 Unique to each TLS client and server CTR SHA-256 Unique to each TLS client and server CTR SHA-384 Unique to each TLS client and server CTR SHA-256