Versions Compared

Old Version 1

changes.mady.by.user Ribbon Communications

Saved on

compared with

New Version Current

changes.mady.by.user Ribbon Communications

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Add_workflow_for_techpubs
AUTH1UserResourceIdentifier{userKey=8a00a0c85bb25531015bc4122a4f0003, userName='null'}
JIRAIDAUTHSBX-71546
REV5UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26cd5909df, userName='null'}
REV6UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26cd5909df, userName='null'}
REV3UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26cef20cc2, userName='null'}
REV1UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26ce8a0be3, userName='null'}

Panel

In this Section:

Table of Contents

 

This object creates and configures Use the TLS profile window to create and configure a profile for implementing the Transport Layer Security (TLS) protocol for use with SIP over TLS. TLS is an IETF protocol for securing communications across an untrusted network. Normally, SIP packets travel in plain text over TCP or UDP connections; Secure SIP is a security measure that uses TLS, the successor to the Secure Sockets Layer (SSL) protocol.

To add a TLS protection-level policy, you create a TLS PROFILE and profile and configure each of the parameters. The Then attach the TLS profile is specified on the SIP Signaling Port and controls to a SIP signaling port to control the behavior of all TLS connections established on that signaling port. An instance of a TLS profile called defaultTlsProfile is present by default, and is used by default by each SIP Signaling Portsignaling port; however, additional TLS profile instances may be created and used instead. The settings within the defaultTlsProfile may also be modified. Also, the The supported transport protocols protocol must be set to allow SIP over TLS over TCP.

Include Page
TLS_version
TLS_version

Include Page
sip-tls-tcp
sip-tls-tcp

To View TLS

Profile

Profiles

On the SBC main screen, go to Configuration > System Provisioning > Security Configuration > TLS Profile. The TLS Profile window is displayed.

Caption
0Figure
1Security Configuration - TLS Profile
Image Removed

 

Click 
Image Modified
to view more parameters.

To Edit a TLS Profile

To edit any of the a TLS Profile in the list, click the radio button next to the specific TLS Profile name.

Caption
0Figure
1Security Configuration - TLS Profile Highlighted
Image Removed

 

The Edit Selected TLS Profile window is displayedopens.

Caption
0Figure
1Security Configuration - TLS Profile Edit Window
 

Make the required changes and click Save at the right hand bottom of the panel to save the changes made.

To Create a TLS Profile

To create a new TLS Profile, click New TLS Profile tab on the TLS Profile List panel.

Caption
0Figure
1Security Configuration - TLS Profile Fields
Image Removed 

 

The Create New TLS Profile window is displayedopens.

Caption
0Figure
1Security Configuration - TLS Profile Create Window

 

The following fields are displayed:Use the following table to configure the options and then click Save.

Caption
0Table
1TLS Profile Parameters
 

Parameter

Description

Name

The name assigned to this Transport Layer Security (TLS) profile. Must be 1 - 23 characters.

You can create a maximum of 16 TLS Profiles.

App Auth Timer

Specifies the higher layer authentication timer in seconds. Must be 1-60 seconds. The default value is 5.

Handshake
Timer

Specifies the time in which the TLS handshake must be completed. The timer starts when the TCP connection is established. Must be 1 - 60 seconds; default is 5.

Session Resume
Timer

Specifies the TLS session resumption period for which cached sessions are retained (in seconds). TLS allows successive connections to be created within one TLS session and the resumption of a session after a TLS connection is closed or after a server card failover, without repeating the entire authentication and other setup steps for each connection, except when the space must be reclaimed for a new session. Must be 0 - 86,400 seconds; default is 3600.

Cipher Suite1

Use this parameter to specify the first TLS Cipher Suite choice for this profile.

  • Nosuite
  • Rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the TLS Record protocol.

  • Rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function.

  • Rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption.  

  • Rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function.

  • Rsa-with-null-sha – The integrity cipher used for the TLS Record protocol. 

  • Tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for TLS Record with AES256 GCM and SHA384 as hash function.

  • Tls_ecdh_ecdsa_with_aes_256_gcm_sha384** – Confidentiality cipher and mode for TLS Record with AES256 CBC and SHA384 as hash function.

  • Tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).

  • tls_ecdhe_rsa_with_aes_128_cbc_sha  – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as hash function.

  • tls_ecdhe_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function.

  • tls-ecdhe-rsa-with-aes-256-gcm-sha-384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function.

  • tls_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function.

  • tls_rsa_with_aes_256_gcm_sha384 – Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function.

* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile.

** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys.

NOTE: When Fips-140-2 mode is enabled, Rsa-with-null-sha should not be used.

Include Page
_FIPS_Releases
_FIPS_Releases

Cipher Suite2

Use this parameter to specify the second TLS Cipher Suite choice for this profile.

  • Nosuite
  • Rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the TLS Record protocol.

  • Rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function.

  • Rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption.  

  • Rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function.

  • Rsa-with-null-sha – The integrity cipher used for the TLS Record protocol. 

  • Tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for TLS Record with AES256 GCM and SHA384 as hash function.

  • Tls_ecdh_ecdsa_with_aes_256_gcm_sha384** – Confidentiality cipher and mode for TLS Record with AES256 CBC and SHA384 as hash function.

  • Tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).

  • tls_ecdhe_rsa_with_aes_128_cbc_sha  – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as hash function.

  • tls_ecdhe_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function.

  • tls-ecdhe-rsa-with-aes-256-gcm-sha-384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function.

  • tls_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function.

  • tls_rsa_with_aes_256_gcm_sha384 – Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function.

* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile.

** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys.

NOTE: When Fips-140-2 mode is enabled, Rsa-with-null-sha should not be used.

Cipher Suite3

Use this parameter to specify the third TLS Cipher Suite choice for this profile.

  • Nosuite
  • Rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the TLS Record protocol.

  • Rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function.

  • Rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption.  

  • Rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function.

  • Rsa-with-null-sha – The integrity cipher used for the TLS Record protocol. 

  • Tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for TLS recode with AES256 GCM and SHA384 as hash function.

  • Tls_ecdh_ecdsa_with_aes_256_gcm_sha384** – Confidentiality cipher and mode for TLS recode with AES256 CBC and SHA384 as hash function.

  • Tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).

  • tls_ecdhe_rsa_with_aes_128_cbc_sha  – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as hash function.

  • tls_ecdhe_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function.

  • tls-ecdhe-rsa-with-aes-256-gcm-sha-384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function.

  • tls_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function.

  • tls_rsa_with_aes_256_gcm_sha384 – Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function.

* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile.

** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys.

NOTE: When Fips-140-2 mode is enabled, Rsa-with-null-sha should not be used.

Allowed Roles

Specifies which role the 

Spacevars
0series
will act in for this TLS profile:   

  • clientandserver (default) 
  • server

Auth Client

Indicates whether or not a TLS client is forced to authenticate itself within TLS. If set to false, the client is not required to authenticate itself at the TLS layer but must complete authentication within a higher-lever protocol after the TLS connection is established (i.e. SIP registration):  

  • true (default)  
  • false

Client Cert
Name

Specifies the name of the default Client Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. Must be 1-23 characters or none.

Server Cert
Name

Specifies the name of the Server Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. Must be 1-23 characters or none.

Acceptable Cert Validation Errors

Use this parameter to specify if certificate chain validation errors are acceptable while validating the peer certificate.

  • Invalid Purpose 
  • none (default)
Ocsp Profile NameSpecifies the name of OCSP profile object referenced by TLS profile.
V1_0

TLS protocol version 1.0.

  • Disabled
  • Enabled (default)
V1_1

TLS protocol version 1.1.

  • Disabled
  • Enabled (default)
V1_2

TLS protocol version 1.2.

  • Disabled
  • Enabled (default)
Suppress Empty Fragments

If enabled, SBC will not insert empty fragments while sending packets on TLS over TCP connection. The options are:

  • Disabled (default)
  • Enabled
Peer Name Verify

If enabled, the SBC verifies the value of the parameter TLS Peer Name. For details on TLS Peer Name, refer to Trunk Group - SIP Trunk Group.

  • Disabled (default)
  • Enabled

To Copy a TLS Profile

To copy any of the created a TLS Profile and to make any minor changes, click the radio button next to the specific TLS Profile to highlight the row.

Caption
0Figure
1Security Configuration - TLS Profile Highlighted
Image Removed

 copy.

Click Copy TLS Profile tab on the TLS Profile List panel.

Caption
0Figure
1Security Configuration - TLS Profile Fields
Image Removed 

 

The Copy Selected TLS Profile window is displayed along with the field details which can be editedopens.

Caption
0Figure
1Security Configuration - TLS Profile Copy Window

 

Make the required changes to the required fields and click Save to save the changes. The copied TLS Profile is displayed at the bottom of the original TLS Profile in the TLS Profile List panel.

To Delete a TLS Profile

To delete any of the created a TLS Profile, click the radio button next to the specific TLS Profile which that you want to delete.

Caption
0Figure
1Security Configuration - TLS Profile Highlighted
Image Removed

 

Click the Delete icon (X) Click Delete at the end of the highlighted row. A delete confirmation message appears seeking your decision.

Caption
0Figure
1Security Configuration - TLS Profile Delete Confirmation
Image Removed

 

Click Yes to remove the specific TLS Profile from the list.

 

Confirm the deletion when prompted. 

Pagebreak