Versions Compared

Old Version 4

changes.mady.by.user Ribbon Communications

Saved on

compared with

New Version Current

changes.mady.by.user Ribbon Communications

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Add_workflow_for_techpubs
AUTH2UserResourceIdentifier{userKey=8a00a0c880e94aad0181077fa2530009, userName='null'}
AUTH1UserResourceIdentifier{userKey=8a00a0c86e9b2550016ec54396b5000a8a00a02355cd1c2f0155cd26cd5909df, userName='null'}
JIRAIDAUTHSBX-122197133197
REV5UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26cb8305e98a00a02355cd1c2f0155cd26cd5909df, userName='null'}
REV6UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26cb8305e98a00a02355cd1c2f0155cd26cd5909df, userName='null'}
REV3UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26cebf0c4f8a00a0c86af1a8d3016afe2f47e10008, userName='null'}
REV1UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26cebf0c4f8a00a02355cd1c2f0155cd26ca7d045b, userName='null'}


Panel

In this section:

Table of Contents



Info
iconfalse

Related articles:



Excerpt

Use the TLS Profile window to create and configure profiles for implementing the Transport Layer Security (TLS) protocol for use with SIP over TLS. TLS is an IETF protocol for securing communications across an untrusted network. Normally, SIP packets travel in plain text over TCP or UDP connections; Secure SIP is a security measure that uses TLS, the successor to the Secure Sockets Layer (SSL) protocol.

To add TLS policy to the SBC you configure a TLS profile. The TLS profile is assigned to the SIP signaling port and controls behavior of all TLS connections established on that signaling port. An instance of a TLS profile called defaultTlsProfile is present by default, and is used by default by each SIP signaling port; however, additional TLS profile instances may be created and used instead. The settings within the defaultTlsProfile may be modified. Also, you must set the supported transport protocols for the SIP signaling port to allow SIP over TLS over TCP.

Include Page
_TLS_version
_TLS_version

Include Page
_sip-tls-tcp
_sip-tls-tcp

To View TLS Profiles

On the SBC main screen, go to Configuration > System Provisioning > Security Configuration > TLS Profile. 

To Create a TLS Profile

To create a new TLS Profile:

  1. Click New TLS Profile. 


  2. Use the following table to configure the options and then click Save. 

    • Nosuite
    • Rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the TLS Record protocol.

    • Rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function.

    • Rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption.  

    • Rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function.

    • Rsa-with-null-sha – The integrity cipher used for the TLS Record protocol. 

    • Tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for TLS Record with AES256 GCM and SHA384 as hash function.

    • Tls_ecdh_ecdsa_with_aes_256_gcm_sha384**** – Confidentiality cipher and mode for TLS Record with AES256 CBC and SHA384 as hash function.

    • Tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).

    • tls_ecdhe_rsa_with_aes_128_cbc_sha  – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as hash function.

    • tls_ecdhe_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function.

    • tls-ecdhe-rsa-with-aes-256-gcm-sha-384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function.

    • tls_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function.

    • tls_rsa_with_aes_256_gcm_sha384 – Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function.

    • tls_aes_128_gcm_sha256*** – Confidentiality cipher and mode for the TLS Record with AES128 GCM and SHA256 as the hash function.
    • tls_aes_256_gcm_sha384*** – Confidentiality cipher and mode for the TLS Record with AES256 GCM and SHA384 as the hash function.
    • tls_chacha20_poly1305_sha256*** – Confidentiality cipher and mode for the TLS Record with ChaCha20-Poly1305 and SHA256 as the hash function.

    * To use this cipher, TLS version 1.2 must be enabled in the TLS Profile.

    ** The SBC 11.1 and later versions do not support tls_ecdh_ecdsa_with_aes_256_cbc_sha384. You must replace it with a valid Cipher before upgrading the SBC.

    *** To use this cipher, TLS version 1.3 must be enabled in the TLS Profile.

    **** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys.

    NOTE: When Fips-140-2 mode is enabled, Rsa-with-null-sha should not be used.

    NOTE: TLS 1.3 does not support RSA. Certificates generated with RSA will not work with TLS 1.3.

    • Nosuite
    • Rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the TLS Record protocol.

    • Rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function.

    • Rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption.  

    • Rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function.

    • Rsa-with-null-sha – The integrity cipher used for the TLS Record protocol. 

    • Tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for TLS Record with AES256 GCM and SHA384 as hash function.

    • Tls_ecdh_ecdsa_with_aes_256_gcm_sha384**** – Confidentiality cipher and mode for TLS Record with AES256 CBC and SHA384 as hash function.

    • Tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).

    • tls_ecdhe_rsa_with_aes_128_cbc_sha  – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as hash function.

    • tls_ecdhe_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function.

    • tls-ecdhe-rsa-with-aes-256-gcm-sha-384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function.

    • tls_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function.

    • tls_rsa_with_aes_256_gcm_sha384 – Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function.

    • tls_aes_128_gcm_sha256*** – Confidentiality cipher and mode for the TLS Record with AES128 GCM and SHA256 as the hash function.
    • tls_aes_256_gcm_sha384*** – Confidentiality cipher and mode for the TLS Record with AES256 GCM and SHA384 as the hash function.
    • tls_chacha20_poly1305_sha256*** – Confidentiality cipher and mode for the TLS Record with ChaCha20-Poly1305 and SHA256 as the hash function.

    * To use this cipher, TLS version 1.2 must be enabled in the TLS Profile.

    ** The SBC 11.1 and later versions do not support tls_ecdh_ecdsa_with_aes_256_cbc_sha384. You must replace it with a valid Cipher before upgrading the SBC.

    *** To use this cipher, TLS version 1.3 must be enabled in the TLS Profile.

    **** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys.

    NOTE: When Fips-140-2 mode is enabled, Rsa-with-null-sha should not be used.

    NOTE: TLS 1.3 does not support RSA. Certificates generated with RSA will not work with TLS 1.3.

    **** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys.
    NOTE: When Fips-140-2 mode is enabled, Rsa-with-null-sha should not be used.
    NOTE: TLS 1.3 does not support RSA. Certificates generated with RSA will not work with TLS 1.3.
    • Nosuite
    • Rsa-with-aes-128-cbc-sha (default) – Confidentiality cipher and mode for the TLS Record protocol.

    • Rsa-with-aes-128-cbc-sha-256 – Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function.

    • Rsa-with-aes-256-cbc-sha – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption.  

    • Rsa-with-aes-256-cbc-sha-256* – Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function.

    • Rsa-with-null-sha – The integrity cipher used for the TLS Record protocol. 

    • tls_ecdh_ecdsa_with_aes_256_cbc_sha384** – Confidentiality cipher and mode for TLS recode with AES256 GCM and SHA384 as hash function.

    • tls_ecdh_ecdsa_with_aes_256_gcm_sha384**** – Confidentiality cipher and mode for TLS recode with AES256 CBC and SHA384 as hash function. 

    • Tls_ecdhe_rsa_with_aes_256_cbc_sha384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange).

    • tls_ecdhe_rsa_with_aes_128_cbc_sha  – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as hash function.

    • tls_ecdhe_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function.

    • tls-ecdhe-rsa-with-aes-256-gcm-sha-384* – Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function.

    • tls_rsa_with_aes_128_gcm_sha256 – Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function.

    • tls_rsa_with_aes_256_gcm_sha384 – Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function.

    • tls_aes_128_gcm_sha256*** – Confidentiality cipher and mode for the TLS Record with AES128 GCM and SHA256 as the hash function.
    • tls_aes_256_gcm_sha384*** – Confidentiality cipher and mode for the TLS Record with AES256 GCM and SHA384 as the hash function.
    • tls_chacha20_poly1305_sha256*** – Confidentiality cipher and mode for the TLS Record with ChaCha20-Poly1305 and SHA256 as the hash function.

    * To use this cipher, TLS version 1.2 must be enabled in the TLS Profile.

    ** The SBC 11.1 and later versions do not support tls_ecdh_ecdsa_with_aes_256_cbc_sha384. You must replace it with a valid Cipher before upgrading the SBC.

    *** To use this cipher, TLS version 1.3 must be enabled in the TLS Profile.

    Parameter

    Description

    Name

    The name assigned to this Transport Layer Security (TLS) profile. Must be 1 - 23 characters.

    For further details, refer to SBC Provisioning Limits

    App Auth Timer

    Specifies the higher layer authentication timer in seconds. Must be 1-60 seconds. The default value is 5.

    Handshake
    Timer

    Specifies the time in which the TLS handshake must be completed. The timer starts when the TCP connection is established. Must be 1 - 60 seconds; default is 5.

    Session Resume
    Timer

    Specifies the TLS session resumption period for which cached sessions are retained (in seconds). TLS allows successive connections to be created within one TLS session and the resumption of a session after a TLS connection is closed or after a server card failover, without repeating the entire authentication and other setup steps for each connection, except when the space must be reclaimed for a new session. Must be 0 - 86,400 seconds; default is 3600.

    Cipher Suite1

    Use this parameter to specify the first TLS Cipher Suite choice for this profile.

    Include Page
    _FIPS_Releases_FIPS_Releases

    (See Supported TLS/DTLS Crypto Suites table below for the list of cipher suites)

    Cipher Suite2

    Use this parameter to specify the second TLS Cipher Suite choice for this profile.

    (See Supported TLS/DTLS Crypto Suites table below for the list of cipher suites)

    Cipher Suite3

    Use this parameter to specify the third TLS Cipher Suite choice for this profile.

    (See Supported TLS/DTLS Crypto Suites table below for the list of cipher suites)

    Allowed Roles

    Specifies which role the 

    Spacevars
    0series
    will act in for this TLS profile:   

    • clientandserver (default) 
    • server

    Auth Client

    Indicates whether or not a TLS client is forced to authenticate itself within TLS.  

    • true (default)  
    • false

    Client Cert
    Name

    Specifies the name of the default Client Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. Must be 1-23 characters or none.

    Server Cert
    Name

    Specifies the name of the Server Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. Must be 1-23 characters or none.

    Acceptable Cert Validation Errors

    Use this parameter to specify if certificate chain validation errors are acceptable while validating the peer certificate.

    • Invalid Purpose 
    • none (default)
    Ocsp Profile NameSpecifies the name of OCSP profile object referenced by TLS profile.
    V1_0

    TLS protocol version 1.0.

    • Disabled
    • Enabled (default)
    V1_1

    TLS protocol version 1.1.

    • Disabled (default)
    • Enabled 
    V1_2

    TLS protocol version 1.2.

    • Disabled (default)
    • Enabled
    V1_3

    TLS protocol version 1.3.

    • Disabled (default)
    • Enabled

    Multiexcerpt include
    MultiExcerptNameTLS V1.3 - EMA
    PageWithExcerpt_v1_3 requires one TLS V1.3 cipher suite

    Suppress Empty Fragments

    If enabled, SBC will not insert empty fragments while sending packets on TLS over TCP connection. The options are:

    • Disabled (default)
    • Enabled
    Peer Name Verify

    If enabled, the SBC verifies the value of the parameter TLS Peer Name. For details on TLS Peer Name, refer to Trunk Group - SIP Trunk Group.

    • Disabled (default)
    • Enabled
    Hash Type

    Specifies the type of TLS hash function allowed for TLS sessions governed by the specified TLS profile. The options are:

    • Md5
    • Sha1(default)
    • Sha224
    • Sha256
    • Sha384
    • Sha512
    Peer Cert Validate

    This flag indicates whether or not the received peer server certificates are validated.

    When set to False, unknown peer Root-CA/self-signed certificates are accepted without any validation. 

    • False
    • True (default)

    Available_since
    TypeAvailable Since
    Release11.1.2

To Edit a TLS Profile

To edit a TLS Profile:

  1. Click the radio button next to the specific TLS Profile name. 
  2.  Make the required changes and click Save.

To Copy a TLS Profile

To copy a TLS Profile and make any minor changes:

  1. Click the radio button next to the specific TLS Profile to copy.
  2. Click Copy TLS Profile. 
  3. Make any required changes and click Save.

To Delete a TLS Profile

To delete a TLS Profile:

  1. Click the radio button next to the specific TLS Profile that you want to delete.
  2. Click the Delete icon (X) at the end of the row. 
  3. Confirm the deletion when prompted.


Anchor
Supported TLS/DTLS Crypto Suites
Supported TLS/DTLS Crypto Suites
Multiexcerpt include
MultiExcerptNameDTLS Crypto Suites Table
PageWithExcerptTLS for Signaling