...
| Caption |
|---|
| 0 | Figure |
|---|
| 1 | Security Configuration - TLS Profile |
|---|
|
| |
Image Modified
Click to view more parameters.
...
| Caption |
|---|
| 0 | Figure |
|---|
| 1 | Security Configuration - TLS Profile Highlighted |
|---|
|
| |
Image Modified
The Edit Selected TLS Profile window is displayed below.
| Caption |
|---|
| 0 | Figure |
|---|
| 1 | Security Configuration - TLS Profile Edit Window |
|---|
|
| |
Image Modified
Make the required changes and click Save at the right hand bottom of the panel to save the changes made.
...
| Caption |
|---|
| 0 | Figure |
|---|
| 1 | Security Configuration - TLS Profile Fields |
|---|
|
| |
Image Modified
The Create New TLS Profile window is displayed.
| Caption |
|---|
| 0 | Figure |
|---|
| 1 | Security Configuration - TLS Profile Create Window |
|---|
|
| |
Image Modified
The following fields are displayed:
Parameter | Description |
|---|
Name
| The name assigned to this Transport Layer Security (TLS) profile. Must be 1 - 23 characters. |
App Auth Timer
| Specifies the higher layer authentication timer in seconds. Must be 1-60 seconds. The default value is 5. |
Handshake
Timer
| Specifies the time in which the TLS handshake must be completed. The timer starts when the TCP connection is established. Must be 1 - 60 seconds; default is 5. |
Session Resume
Timer
| Specifies the TLS session resumption period for which cached sessions are retained (in seconds). TLS allows successive connections to be created within one TLS session and the resumption of a session after a TLS connection is closed or after a server card failover, without repeating the entire authentication and other setup steps for each connection, except when the space must be reclaimed for a new session. Must be 0 - 86,400 seconds; default is 3600. |
Cipher Suite1 | Use this parameter to specify the first TLS Cipher Suite choice for this profile. nosuitersa-with-3des-ede-cbc-sha – Authentication mechanism in the TLS Handshake protocol.
rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the TLS Record protocol.rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function.
rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption. rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function.
rsa-with-null-sha – The integrity cipher used for the TLS Record protocol.
tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for TLS recode with AES256 GCM and SHA384 as hash function.tls_ecdh_ecdsa_with_aes_256_gcm_sha384** – Confidentiality cipher and mode for TLS recode with AES256 CBC and SHA384 as hash function.
tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).
* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile. ** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys. | Note |
|---|
When fips-140-2 mode is enabled, rsa-with-null-sha should not be used. |
| Note |
|---|
The new ciphers, rsa-with-aes-256-cbc-sha, rsa-with-aes-256-cbc-sha-256, and tls_ecdhe_rsa_with_aes_256_cbc_sha384 are available from 4.0.2 Release. |
|
Cipher Suite2 | Use this parameter to specify the second TLS Cipher Suite choice for this profile. nosuitersa-with-3des-ede-cbc-sha – Authentication mechanism in the TLS Handshake protocol.
rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the TLS Record protocol.rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function.
rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption. rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function.
rsa-with-null-sha – The integrity cipher used for the TLS Record protocol.
tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for TLS recode with AES256 GCM and SHA384 as hash function.tls_ecdh_ecdsa_with_aes_256_gcm_sha384** – Confidentiality cipher and mode for TLS recode with AES256 CBC and SHA384 as hash function.
tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).
* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile. ** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys. | Note |
|---|
When fips-140-2 mode is enabled, rsa-with-null-sha should not be used. |
| Note |
|---|
The new ciphers, rsa-with-aes-256-cbc-sha, rsa-with-aes-256-cbc-sha-256, and tls_ecdhe_rsa_with_aes_256_cbc_sha384 are available from 4.0.2 Release. |
|
Cipher Suite3 | Use this parameter to specify the third TLS Cipher Suite choice for this profile. nosuitersa-with-3des-ede-cbc-sha – Authentication mechanism in the TLS Handshake protocol.
rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the TLS Record protocol.rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function.
rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption. rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function.
rsa-with-null-sha – The integrity cipher used for the TLS Record protocol.
tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for TLS recode with AES256 GCM and SHA384 as hash function.tls_ecdh_ecdsa_with_aes_256_gcm_sha384** – Confidentiality cipher and mode for TLS recode with AES256 CBC and SHA384 as hash function.
tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).
* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile. ** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys. | Note |
|---|
When fips-140-2 mode is enabled, rsa-with-null-sha should not be used. |
| Note |
|---|
The new ciphers, rsa-with-aes-256-cbc-sha, rsa-with-aes-256-cbc-sha-256, and tls_ecdhe_rsa_with_aes_256_cbc_sha384 are available from 4.0.2 Release. |
|
Allowed Roles
| Specifies which role the will act in for this TLS profile:
• server
• clientandserver (default) |
Auth Client
| Indicates whether or not a TLS client is forced to authenticate itself within TLS. If set to false, the client is not required to authenticate itself at the TLS layer but must complete authentication within a higher-lever protocol after the TLS connection is established (i.e. SIP registration):
• true (default)
• false |
Client Cert
Name
| Specifies the name of the default Client Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. Must be 1-23 characters or none. |
Server Cert
Name
| Specifies the name of the Server Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. Must be 1-23 characters or none. |
Acceptable Cert Validation Errors | Use this parameter to specify if certificate chain validation errors are acceptable while validating the peer certificate. invalidPurpose none (default)
|
Ocsp Profile Name | Specifies the name of OCSP profile object referenced by TLS profile. |
V1_0 | TLS protocol version 1.0. disabled enabled (default)
|
V1_1 | TLS protocol version 1.1. disabled enabled (default)
|
V1_2 | TLS protocol version 1.2. disabled enabled (default)
|
Suppress Empty Fragments | If enabled, SBC will not insert empty fragments while sending packets on TLS over TCP connection. The options are: - disabled (default)
- enabled
| Note |
|---|
This field is available from 4.0.2 release. |
|
To Copy TLS Profile
To copy any of the created TLS Profile and to make any minor changes, click the radio button next to the specific TLS Profile to highlight the row.
| Caption |
|---|
| 0 | Figure |
|---|
| 1 | Security Configuration - TLS Profile Highlighted |
|---|
|
| |
Image Modified
Click Copy TLS Profile tab on the TLS Profile List panel.
| Caption |
|---|
| 0 | Figure |
|---|
| 1 | Security Configuration - TLS Profile Fields |
|---|
|
| |
Image Modified
The Copy Selected TLS Profile window is displayed along with the field details which can be edited.
| Caption |
|---|
| 0 | Figure |
|---|
| 1 | Security Configuration - TLS Profile Copy Window |
|---|
|
| |
Image Modified
Make the required changes to the required fields and click Save to save the changes. The copied TLS Profile is displayed at the bottom of the original TLS Profile in the TLS Profile List panel.
...
| Caption |
|---|
| 0 | Figure |
|---|
| 1 | Security Configuration - TLS Profile Highlighted |
|---|
|
| |
Image Modified
Click Delete at the end of the highlighted row. A delete confirmation message appears seeking your decision.
| Caption |
|---|
| 0 | Figure |
|---|
| 1 | Security Configuration - TLS Profile Delete Confirmation |
|---|
|
| |
Image Modified
Click OK to remove the specific TLS Profile from the list.
...