In this section:
Use the TLS Profile to configure a profile for implementing the TLS protocol for SIP over TLS. A TLS profile is assigned to the SIP signaling port and controls behavior of all TLS connections established on that signaling port. An instance of a TLS profile called defaultTlsProfile is present by default, and is used by default by each SIP signaling port; however, additional TLS profile instances may be created and used instead.
The settings within the default TLS profile may be modified. Also, the supported transport protocols on the SIP signaling port must be set to allow SIP over TLS.
If a zone's sipSigPort
is configured for transportProtocolsAllowed
= sip-tls-tcp
, the SBC increments the configured portNumber
by 1 and uses it as the new port number for SIP over TLS signaling. The SBC then opens a TCP socket for SIP over TLS for the new TCP port number.
Example: When sipSigPort
is configured with a portNumber
of 5060 and transportProtocolsAllowed
= sip-tls-tcp
, the SBC listens on TCP port 5061 for SIP over TLS.
Command Syntax
% set profiles security tlsProfile <profile name> acceptableCertValidationErrors <invalidPurpose | none> allowedRoles <clientandserver | server> appAuthTimer <1-60 seconds> authClient <false | true> cipherSuite1 <cipher suite> cipherSuite2 <cipher suite> cipherSuite3 <cipher suite> clientCertName <name> handshakeTimer <1-60 seconds> hashType <md5 | sha1 | sha224 | sha256 | sha384 | sha512> ocspProfileName <name> peerNameVerify <disabled | enabled> serverCertName <name> sessionResumpTimer <0-86400 seconds> suppressEmptyFragments <disabled | enabled> v1_0 <disabled | enabled> v1_1 <disabled | enabled> v1_2 <disabled | enabled>
Command Parameters
The TLS Profile Parameters are as shown below:
The
Supported DTLS Crypto Suites Authentication Mechanism Confidentiality Cipher and Mode Integrity Cipher RSA-WITH-NULL-SHA The integrity cipher used for the TLS Record protocol. RSA-WITH-AES-128-CBC-SHA (default) Confidentiality cipher and mode for the TLS Record protocol. AES-128-CBC SHA-1 RSA-WITH-AES-128-CBC-SHA-256 Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function. RSA-WITH-AES-256-CBC-SHA Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption. RSA AES-256-CBC SHA-1 RSA-WITH-AES-256-CBC-SHA-256* Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function. RSA AES-256-CBC SHA-256 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384** Confidentiality cipher and mode for the TLS Record with AES256 CBC and SHA384 as the hash function. ECDH-ECDSA AES-256-CBC SHA-384 TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384** Confidentiality cipher and mode for the TLS Record with AES256 GCM and SHA384 as the hash function. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as the hash function. TLS_ECDHE-RSA-WITH-AES-256-CBC-SHA-384* Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 CBC and SHA384 as the hash function. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function. TLS_ECDHE-RSA-WITH-AES-256-GCM-SHA-384* Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function. TLS_RSA_WITH_AES_128_GCM_SHA256 Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function. TLS_RSA_WITH_AES_256_GCM_SHA384 Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function. * To use this cipher, you must enable TLS version 1.2 in the TLS Profile. ** To use this cipher, you must enable TLS version 1.2 in the TLS Profile and create SSL certificates using ECC keys. When the Fips-140-3 mode is enabled, do not use the algorithms whose key exchange method is RSA, including: The SBC 7.2.x release supports FIPS-140-2 and the 10.1.3 release supports FIPS-140-3. FIPS-140-2 is not supported in 10.1.3 and later releases and gets automatically converted to FIPS-140-3 as part of the upgrade. To verify the current status of FIPS certification, contact the Global Support Assistance Center:Public/Private Key Pair RSA NULL SHA-1 RSA RSA AES-128-CBC SHA-256 ECDH-ECDSA AES-256-GCM SHA-384 ECDHE-RSA AES-128-CBC SHA-1 ECDHE-RSA AES-256-CBC SHA-384 ECDHE-RSA AES-128-GCM SHA-256 ECDHE-RSA AES-256-GCM SHA-384 RSA AES_128_GCM SHA256 RSA AES_256_GCM SHA384
Command Examples
> show profiles security tlsProfile defaultTlsProfile appAuthTimer 5; handshakeTimer 5; hashType Sha1; sessionResumpTimer 3600; cipherSuite1 rsa-with-aes-128-cbc-sha; allowedRoles clientandserver; v1_0 enabled; v1_1 enabled; v1_2 enabled; % set profiles security tlsProfile defaultTlsProfile ocspProfileName myOcspProfile % commit > show profiles security tlsProfile defaultTlsProfile appAuthTimer 5; handshakeTimer 5; hashType Sha1; sessionResumpTimer 3600; cipherSuite1 rsa-with-aes-128-cbc-sha; allowedRoles clientandserver; ocspProfileName myOcspProfile; v1_0 enabled; v1_1 enabled; v1_2 enabled;
% set profiles security tlsProfile TLS-1 v1_2 enabled % set profiles security tlsProfile TLS-1 cipherSuite1 tls_ecdh_ecdsa_with_aes_256_gcm_sha384 % commit > show profiles security tlsProfile TLS-1 cipherSuite1 tls_ecdh_ecdsa_with_aes_256_gcm_sha384; v1_2 enabled;