Page History

SBX-27890

add_docset_workflow

APPRJID

workflow_for_techpubs

AUTH1	pmohan
DEV2	kpatchamatla
DEV1	rseth
LDEV1	sgardell
SVT1	spolisetti
LSVT1	radaikalam
AUTHJID	SBX-27890

Noprint

Panel

borderColor	green
bgColor	transparent
borderWidth	2

Back to Table of Contents

Back to All

Back to All - Profiles

Back to Profiles - Security

UserResourceIdentifier{userKey=8a00a0c85bb25531015bc4122a4f0003, userName='null'}
JIRAIDAUTH	SBX-71546
REV5	UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26cd5909df, userName='null'}
REV6	UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26cd5909df, userName='null'}
REV3	UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26cef20cc2, userName='null'}
REV1	UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26ce8a0be3, userName='null'}

Panel

In this section:

Table of Contents

maxLevel	2

The Datagram Transport Layer Security (DTLS) protocol is designed to provide authentication, data integrity, and confidentiality for communications between two applications over an Unreliable Datagram Protocol (UDP). The Secure Real-time Transport Protocol (SRTP) provides encryption, message authentication and integrity, and replay protection to the RTP data in both unicast and multicast applications. DTLS-SRTP is an extension to the DTLS protocol, where DTLS acts as the key management protocol. DTLS protocol is also extended to negotiate the SRTP crypto suites and parameters for use with those keys.

WebRTC is a signaling protocol defined for the real time communication between the Web Browsers. WebRTC has assigned DTLS-SRTP protocol for the media exchange between the browsers. With the implementation of this feature, SBC supports:

Real time communication between the web browsers by using DTLS-SRTP while inter-working with SIP networks.
DTLS on the media path for key management for the SRTP based media.
The self-signed certificates to secure and authenticate DTLS associations. DTLS connections are secured by the two browsers sharing self-signed certificates as part of the media connection during a DTLS handshake between the browsers. The certificates are authenticated by checking a fingerprint, which is passed in the signaling path as part of the Session Description Protocol (SDP).

To View Dtls Profile

Multiexcerpt include

MultiExcerptName	DTLS Crypto Suites
PageWithExcerpt	TLS for Signaling

To View DTLS Profiles

On the On SBC main screen, go to All > Profiles > Security > Dtls Profile. The Dtls DTLS Profile window is displayedopens.

Caption

0	Figure
1	Security - Dtls DTLS Profile List Window

Image Modified

To Edit

...

a DTLS Profile

To edit any of the Dtls Profile in the lista DTLS Profile, click the radio button next to the specific Dtls Profile DTLS Profile name.

Caption

0	Figure
1	Security - Dtls Profile Highlighted

Image Removed

The Edit Selected Dtls Profile window is displayed belowopens.

Caption

0	Figure
1	Security - Dtls Edit DTLS Profile Edit

Image Modified

Make the required changes and click Save at the right hand bottom of the panel to save the changes made.

To Create

...

a DTLS Profile

To create a new Dtls ProfileDTLS Profile, click New Dtls Profile tab on the Dtls Profile List panel.

Caption

0	Figure
1	Security - Dtls Profile Fields

Image Removed

The Create New Dtls Profile window is displayedopens.

Caption

0	Figure
1	Security - Dtls Create DTLS Profile Create

Image Modified

The following fields are displayed:Use the following table to configure the options and then click Save.

Caption

0	Table
1	Dtls Profile Parameters

Parameter	Description
`Name`	Specifies the name of the

...

DTLS Profile created. The value ranges up to 23 characters.
`Handshake Timer`	Specifies the time in which the

...

DTLS handshake must be completed. The timer starts when the TCP connection is established. Must be 1 - 60 seconds; default is 5.
`Session Resump Timer`	Specifies the

...

DTLS session resumption period for which cached sessions are retained (in seconds).

...

DTLS allows successive connections to be created within one

...

DTLS session and the resumption of a session after a

...

DTLS connection is closed or after a server card failover, without repeating the entire authentication and other setup steps for each connection, except when the space must be reclaimed for a new session. Must be 0 - 86,400 seconds; default is 300.
`Cipher Suite1`	Use this parameter to specify the first

...

DTLS Cipher Suite choice for this profile.

nosuite
rsa-with-

...

aes-128-cbc-sha (default) – Confidentiality cipher and mode for the

...

DTLS Record protocol.
rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the

...

DTLS Record protocol with SHA-256 as the hash function.
rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the

...

DTLS Record protocol with AES 256 encryption.
rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the

...

DTLS Record protocol with AES 256 encryption and SHA-256 as the hash function.
rsa-with-null-sha – The integrity cipher used for the

...

DTLS Record protocol.
tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for

...

DTLS Record with AES256 GCM and SHA384 as hash function.
tls_ecdh_ecdsa_with_aes_256_gcm_sha384** – Confidentiality cipher and mode for

...

DTLS Record with AES256 CBC and SHA384 as hash function.
tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the

...

DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).
tls_ecdhe_rsa_with_aes_128_cbc_sha – Confidentiality cipher and mode for the

...

DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as hash function.
tls_ecdhe_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function.
tls-ecdhe-rsa-with-aes-256-gcm-sha-384* – Confidentiality cipher and mode for the DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function.
tls_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the DTLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function.
tls_rsa_with_aes_256_gcm_sha384 – Confidentiality cipher and mode for the DTLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function.

* To use this cipher,

...

DTLS version 1.2 must be enabled in the

...

DTLS Profile.

** To use this cipher,

...

DTLS version 1.2 must be enabled in the

...

DTLS Profile and SSL certificates must be created using ECC keys.

...

Warning: When fips-140-2 mode is enabled, rsa-with-null-sha should not be used.

Include Page

	_FIPS_Releases
	_FIPS_Releases

Cipher Suite2

Use this parameter to specify the second

...

DTLS Cipher Suite choice for this profile.

nosuite (default)

...

rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the

...

DTLS Record protocol.
rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the

...

DTLS Record protocol with SHA-256 as the hash function.
rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the

...

DTLS Record protocol with AES 256 encryption.
rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the

...

DTLS Record protocol with AES 256 encryption and SHA-256 as the hash function.
rsa-with-null-sha – The integrity cipher used for the

...

DTLS Record protocol.
tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for

...

DTLS Record with AES256 GCM and SHA384 as hash function.
tls_ecdh_ecdsa_with_aes_256_gcm_sha384** – Confidentiality cipher and mode for

...

DTLS Record with AES256 CBC and SHA384 as hash function.
tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the

...

DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).
tls_ecdhe_rsa_with_aes_128_cbc_sha – Confidentiality cipher and mode for the

...

DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as hash function.
tls_ecdhe_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function.
tls-ecdhe-rsa-with-aes-256-gcm-sha-384* – Confidentiality cipher and mode for the DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function.
tls_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the DTLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function.
tls_rsa_with_aes_256_gcm_sha384 – Confidentiality cipher and mode for the DTLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function.

* To use this cipher, Dtls version 1.2 must be enabled in the

...

DTLS Profile.

** To use this cipher, Dtls version 1.2 must be enabled in the

...

DTLS Profile and SSL certificates must be created using ECC keys.

...

Warning: When fips-140-2 mode is enabled, rsa-with-null-sha should not be used.

Cipher Suite3

...

Use this parameter to specify the third

...

DTLS Cipher Suite choice for this profile.

nosuite (default)

...

rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the

...

DTLS Record protocol.
rsa-with-aes-128-cbc-sha-256 –

...

Confidentiality cipher and mode for the

...

DTLS Record protocol with SHA-256 as the hash

...

function.
rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the

...

DTLS Record protocol with AES 256 encryption.
rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the

...

DTLS Record protocol with AES 256 encryption and SHA-256 as the hash function.
rsa-with-null-sha – The integrity cipher used for the

...

DTLS Record protocol.
tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for

...

DTLS Record with AES256 GCM and SHA384 as hash function.
tls_ecdh_ecdsa_with_aes_256_gcm_sha384** – Confidentiality cipher and mode for

...

DTLS Record with AES256 CBC and SHA384 as hash function.
tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the

...

DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).
tls_ecdhe_rsa_with_aes_128_cbc_sha – Confidentiality cipher and mode for the

...

DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as hash function.
tls_ecdhe_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function.
tls-ecdhe-rsa-with-aes-256-gcm-sha-384* – Confidentiality cipher and mode for the DTLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function.
tls_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the DTLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function.
tls_rsa_with_aes_256_gcm_sha384 – Confidentiality cipher and mode for the DTLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function.

* To use this cipher,

...

DTLS version 1.2 must be enabled in the

...

DTLS Profile.

** To use this cipher,

...

DTLS version 1.2 must be enabled in the

...

DTLS Profile and SSL certificates must be created using ECC keys.

...

Warning: When `fips-140-2` mode is enabled, `rsa-with-null-sha` should not be used.
`Dtls Role`	Specifies the allowed DTLS roles of this DTLS profile. The options are: `Client` `Server` (default)
`Hash Type`	Specifies the allowed DTLS hash function for a specified DTLS profile. The options are: `Md2` `Md5` `Sha1` (default) `Sha224` `Sha256` `Sha384` `Sha512`
`Cert Name`	Specifies the name of the certificate referred by a specified DTLS profile. The default value is `defaultDtlsSBCCert`.
`Cookie Exchange`	Specifies the state that is, enabled or disabled cookie exchange. `disabled` `enabled` (default)
`V1_0`

...

DTLS protocol version 1.0.

disabled
enabled (default)

V1_1

...

DTLS protocol version 1.1.

disabled (default)
enabled

...

V1_2

...

DTLS protocol version 1.2.

disabled (default)
enabled

To Copy a Dtls Profile

To copy any of the created Dtls Profile and to a DTLS Profile and make any minor changes, click the radio button next to the specific Dtls Profile to highlight the row.

...

0	Figure
1	Security - Dtls Profile Highlighted

...

copy.

Click Copy Dtls Profile tab on the Dtls Profile List panel.

Caption

0	Figure
1	Security - Dtls Profile Fields

Image Removed

The Copy Selected Dtls Profile window is displayed along with the field details which can be editedopens.

Caption

0	Figure
1	Security - Dtls Copy DTLS Profile Copy

Image Modified

Make the required changes to the required fields and click Save to save the changes. The copied Dtls Profile is displayed at the bottom of the original Dtls Profile in the Dtls Profile List panel.

To Delete

...

a DTLS Profile

To delete any of the created Dtls Profilea DTLS Profile, click the radio button next to the specific Dtls Profile which DTLS Profile that you want to delete.

...

Image Removed

Click Delete Click the Delete icon (X) at the end of the highlighted row. A delete confirmation message appears seeking your decision.

Caption

0	Figure
1	Security - Dtls Profile Delete Confirmation

Image Removed

Click Yes to remove the specific Dtls Profile from the list.

.

Confirm the deletion when prompted.

Space shortcuts

Page tree

Versions Compared

Old Version 1

New Version Current

Key

To View Dtls Profile

To View DTLS Profiles

To Edit

a DTLS Profile

To Create

a DTLS Profile

To Copy a Dtls Profile

To Delete

a DTLS Profile