Page History
| Add_workflow_for_techpubs | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
...
| borderColor | green |
|---|---|
| bgColor | transparent |
| borderWidth | 2 |
...
| Panel |
|---|
In this |
...
Section:
|
...
...
This object creates and configures a profile for implementing the Transport Layer Security (TLS) protocol for use with SIP over TLS. TLS is an IETF protocol for securing communications across an untrusted network. Normally, SIP packets travel in plain text over TCP or UDP connections; Secure SIP is a security measure that uses TLS, the successor to the Secure Sockets Layer (SSL) protocol.
To add a TLS protection-level policy, you create a TLS PROFILE and configure each of the parameters. The TLS
...
profile is specified on the SIP Signaling Port and controls behavior of all TLS connections established on that signaling port. An instance of a TLS profile called defaultTlsProfile is present by default, and is used by default by each
...
SIP Signaling Port; however, additional TLS profile instances may be created and used. The settings within the defaultTlsProfile may be modified. Also, the supported transport protocols must be set to allow SIP over TLS over TCP.
| Include Page | ||||
|---|---|---|---|---|
|
| Include Page | ||||
|---|---|---|---|---|
|
To View TLS
...
Profiles
On the SBC main screen, go to Configuration > System Provisioning > Security Configuration > TLS Profile. The TLS Profile window
...
opens.
| Caption | ||||
|---|---|---|---|---|
|
...
...
...
To Edit a TLS Profile
To edit
...
a TLS Profile
...
, click the radio button next to the specific TLS Profile name.
...
| Caption | ||||
|---|---|---|---|---|
| ||||
The Edit Selected TLS Profile window
...
opens.
| Caption | ||||
|---|---|---|---|---|
|
...
Make the required changes and click Save
...
.
To Create a TLS Profile
To create a new TLS Profile, click New TLS Profile
...
.
...
| Caption | ||||
|---|---|---|---|---|
| ||||
The Create New TLS Profile window
...
opens.
| Caption | ||||
|---|---|---|---|---|
|
...
...
Use the following table to configure the options and then click Save.
| Caption | ||||
|---|---|---|---|---|
| ||||
Parameter | Description |
|---|---|
| The name assigned to this Transport Layer Security (TLS) profile. Must be 1 - 23 characters. You can create a maximum of 16 TLS profiles. |
| Specifies the higher layer authentication timer in seconds. Must be 1-60 seconds. The default value is 5. |
| Specifies the time in which the TLS handshake must be completed. The timer starts when the TCP connection is established. Must be 1 - 60 seconds; default is 5. |
| Specifies the TLS session resumption period for which cached sessions are retained (in seconds). TLS allows successive connections to be created within one TLS session and the resumption of a session after a TLS connection is closed or after a server card failover, without repeating the entire authentication and other setup steps for each connection, except when the space must be reclaimed for a new session. Must be 0 - 86,400 seconds; default is 3600. |
Cipher Suite1 | Use this parameter to specify the first TLS Cipher Suite choice for this profile. |
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile. ** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys. |
...
NOTE: When |
...
|
...
|
...
| ||||||
Cipher Suite2 | Use this parameter to specify the second TLS Cipher Suite choice for this profile. |
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile. ** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys. |
...
NOTE: When |
...
|
...
|
...
...
The new ciphers, rsa-with-aes-256-cbc-sha, rsa-with-aes-256-cbc-sha-256, and tls_ecdhe_rsa_with_aes_256_cbc_sha384 are available from 4.0.2 Release.
Cipher Suite3 | Use this parameter to specify the third TLS Cipher Suite choice for this profile. |
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
...
|
...
|
...
|
...
|
...
|
...
* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile. ** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys. |
...
| NOTE: When |
...
Fips-140-2 mode is enabled, |
...
Rsa-with-null-sha should not be used. |
...
...
The new ciphers, rsa-with-aes-256-cbc-sha, rsa-with-aes-256-cbc-sha-256, and tls_ecdhe_rsa_with_aes_256_cbc_sha384 are available from 4.0.2 Release.
| Specifies which role the |
...
|
...
| |
| Indicates whether or not a TLS client is forced to authenticate itself within TLS. If set to false, the client is not required to authenticate itself at the TLS layer but must complete authentication within a higher-lever protocol after the TLS connection is established (i.e. SIP registration): |
...
|
...
| |
| Specifies the name of the default Client Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. Must be 1-23 characters or none. |
| Specifies the name of the Server Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. Must be 1-23 characters or none. |
Acceptable Cert Validation Errors | Use this parameter to specify if certificate chain validation errors are acceptable while validating the peer certificate. |
...
| |
Ocsp Profile Name | Specifies the name of OCSP profile object referenced by TLS profile. |
V1_0 | TLS protocol version 1.0. |
...
|
...
| |
V1_1 | TLS protocol version 1.1. |
...
|
...
| |
V1_2 | TLS protocol version 1.2. |
...
|
...
| |
Suppress Empty Fragments | If enabled, SBC will not insert empty fragments while sending packets on TLS over TCP connection. The options are: |
...
|
...
|
| Note |
|---|
This field is available from 4.0.2 release. |
Peer Name Verify | If enabled, the SBC verifies the value of the parameter
|
To Copy a
...
TLS Profile
To copy
...
a TLS Profile and
...
make any minor changes, click the radio button next to the specific TLS Profile to
...
copy.
...
...
| 0 | Figure |
|---|---|
| 1 | Security Configuration - TLS Profile Highlighted |
...
Click Copy
...
TLS Profile
...
.
...
| Caption | ||||
|---|---|---|---|---|
| ||||
The Copy Selected TLS Profile window
...
opens.
| Caption | ||||
|---|---|---|---|---|
|
...
Make
...
any required changes
...
and click Save
...
.
To Delete a TLS Profile
To delete
...
a TLS Profile, click the radio button next to the specific TLS Profile
...
that you want to delete.
...
| Caption | ||||
|---|---|---|---|---|
| ||||
...
Click the Delete icon (X) at the end of the
...
row
...
.
...
| Caption | ||||
|---|---|---|---|---|
| ||||
Click OK to remove the specific TLS Profile from the list.
...
Confirm the deletion when prompted.
| Pagebreak |
|---|
Overview
Content Tools