Add_workflow_for_techpubs | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Panel | ||||
---|---|---|---|---|
In this section:
|
Use the TLS Profile to configure a profile for implementing the TLS protocol for SIP over TLS. A TLS profile is assigned to the SIP signaling port and controls behavior of all TLS connections established on that signaling port. An instance of a TLS profile called defaultTlsProfile is present by default, and is used by default by each SIP signaling port; however, additional TLS profile instances may be created and used instead.
Info | ||
---|---|---|
| ||
The settings within the default TLS profile may be modified. Also, the supported transport protocols on the SIP signaling port must be set to allow SIP over TLS. |
Include Page | ||||
---|---|---|---|---|
|
Code Block | ||
---|---|---|
| ||
% set profiles security tlsProfile <profile name> acceptableCertValidationErrors <invalidPurpose | none> allowedRoles <clientandserver | server> appAuthTimer <1-60 seconds> authClient <false | true> cipherSuite1 <cipher suite> cipherSuite2 <cipher suite> cipherSuite3 <cipher suite> clientCertName <name> handshakeTimer <1-60 seconds> hashType <md5 | sha1 | sha224 | sha256 | sha384 | sha512> ocspProfileName <name> peerNameVerify <disabled | enabled> serverCertName <name> sessionResumpTimer <0-86400 seconds> suppressEmptyFragments <disabled | enabled> v1_0 <disabled | enabled> v1_1 <disabled | enabled> v1_2 <disabled | enabled> |
The TLS Profile Parameters are as shown below:
Caption | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Include Page | ||||
---|---|---|---|---|
|
The
includes crypto suites that define a set of ciphers (algorithms used for encrypting data) which allow the selection of an appropriate level of security. The crypto suites are supported for both TLS and DTLS (Datagram Transport Layer Security) connections. When a TLS or DTLS connection is established, the client and server exchange information about which cipher suites they have in common. Refer to SBC for WRTC for more information on DTLS. The following crypto suites are supported. Spacevars 0 product
Anchor | ||||
---|---|---|---|---|
|
Multiexcerpt include | ||||
---|---|---|---|---|
|
Code Block | ||
---|---|---|
| ||
> show profiles security tlsProfile defaultTlsProfile appAuthTimer 5; handshakeTimer 5; hashType Sha1; sessionResumpTimer 3600; cipherSuite1 rsa-with-aes-128-cbc-sha; allowedRoles clientandserver; v1_0 enabled; v1_1 enabled; v1_2 enabled; % set profiles security tlsProfile defaultTlsProfile ocspProfileName myOcspProfile % commit > show profiles security tlsProfile defaultTlsProfile appAuthTimer 5; handshakeTimer 5; hashType Sha1; sessionResumpTimer 3600; cipherSuite1 rsa-with-aes-128-cbc-sha; allowedRoles clientandserver; ocspProfileName myOcspProfile; v1_0 enabled; v1_1 enabled; v1_2 enabled; |
Code Block | ||
---|---|---|
| ||
% set profiles security tlsProfile TLS-1 v1_2 enabled % set profiles security tlsProfile TLS-1 cipherSuite1 tls_ecdh_ecdsa_with_aes_256_gcm_sha384 % commit > show profiles security tlsProfile TLS-1 cipherSuite1 tls_ecdh_ecdsa_with_aes_256_gcm_sha384; v1_2 enabled; |
Pagebreak |
---|