You are viewing an old version of this page. View the current version.
Compare with Current
View Page History
Version 1
Current »
Use the TLS Profile to configure a profile for implementing the TLS protocol for SIP over TLS. A TLS profile is assigned to the SIP signaling port and controls behavior of all TLS connections established on that signaling port. An instance of a TLS profile called defaultTlsProfile is present by default, and is used by default by each SIP signaling port; however, additional TLS profile instances may be created and used instead.
Command Syntax
% set profiles security tlsProfile <profile name>
acceptableCertValidationErrors <invalidPurpose | none>
allowedRoles <clientandserver | server>
appAuthTimer <1-60 seconds>
authClient <false | true>
cipherSuite1 <cipher suite>
cipherSuite2 <cipher suite>
cipherSuite3 <cipher suite>
clientCertName <name>
handshakeTimer <1-60 seconds>
ocspProfileName <name>
peerNameVerify <disabled | enabled>
serverCertName <name>
sessionResumpTimer <0-86400 seconds>
suppressEmptyFragments <disabled | enabled>
v1_0 <disabled | enabled>
v1_1 <disabled | enabled>
v1_2 <disabled | enabled>
Command Parameters
The TLS Profile Parameters are as shown below:
Parameter | Length/Range | Description |
---|
tlsProfile
| 1-23 | <name> - Name assigned to this Transport Layer Security (TLS) profile. You can create a maximum of 16 TLS Profiles.
|
acceptableCertValidationErrors | N/A | Use this parameter to specify if certificate chain validation errors are acceptable while validating the peer certificate. invalidPurpose none (default)
|
allowedRoles
| N/A | Allowed TLS roles for this TLS profile. |
appAuthTimer
| 1-60 | The higher layer authentication timer in seconds. (default = 5). |
authClient
| N/A | Indicates whether or not a TLS client is forced to authenticate itself within TLS. If set to false, the client is not required to authenticate itself at the TLS layer, but must complete authentication within a higher-level protocol after the TLS connection is established (that is, SIP registration). |
cipherSuite1
| N/A | Use this parameter to specify the first TLS Cipher Suite choice for this profile. See Supported Cipher Suites table below for the list of cipher suites. |
cipherSuite2
| N/A | Use this optional parameter to specify the second TLS Cipher Suite choice for this profile. See Supported Cipher Suites table below for the list of cipher suites. |
cipherSuite3
| N/A | Use this optional parameter to specify the third TLS Cipher Suite choice for this profile. See Supported Cipher Suites table below for the list of cipher suites. |
clientCertName
| 1-23 | The name of the default Client Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. |
handshakeTimer
| 1-60 | The time (in seconds) in which the TLS handshake must be completed. The timer starts when the TCP connection is established. (default = 5) |
ocspProfileName | 1-23 | Name of OCSP profile object referenced by TLS profile. |
peerNameVerify | N/A | This flag is used to verify the authenticity of a client certificate. When enabled, the Unable to show "metadata-from": No such page "_space_variables" validates the TLS peer name of the SIP peer against either a Common Name (CN) present in the subject or the DNS names or IP addresses in the Subject Alternate Name Extension (SAN) field in the certificate presented by the peer. For example, if the Unable to show "metadata-from": No such page "_space_variables" establishes a TLS session with "sonus.customer.net", this feature verifies the CN in the subject (or a DNS entry in the SAN field) of the certificate contains "sbc.customer.net" as the value. disabled (default)
enabled
NOTE: This flag is used in conjunction with the trunk group parameter, tlsPeerName , which associates the TLS peer name with a trunk group. Refer to SIP TG - Signaling - TLS Peer Name - CLI for details. |
serverCertName
| 1-23 | Specifies the name of the Server Certificate to be used by this TLS profile, created using the SECURITY PKI configuration object. |
sessionResumpTimer
| 0-86400 | The TLS session resumption period (in seconds) for which cached sessions are retained. TLS allows successive connections to be created within one TLS session (and the resumption of a session after a TLS connection is closed or after a server card failover) without repeating the entire authentication and other setup steps for each connection, except when the space must be reclaimed for a new session. (default = 3600) |
suppressEmptyFragments | N/A | Enable flag to prevent the Unable to show "metadata-from": No such page "_space_variables" from inserting empty fragments when sending packets on TLS over TCP connection in support of older versions of TLS implementation. disabled (default)
enabled
|
v1_0 | N/A | TLS protocol version 1.0 (see note below) disabled enabled (default)
|
v1_1 | N/A | TLS protocol version 1.1 (see note below) disabled (default)
enabled
|
v1_2 | N/A | TLS protocol version 1.2 (see note below) disabled (default)
enabled
|
The Unable to show "metadata-from": No such page "_space_variables"
includes crypto suites that define a set of ciphers (algorithms used for encrypting data) which allow the selection of an appropriate level of security. The crypto suites are supported for both TLS and DTLS (Datagram Transport Layer Security) connections. When a TLS or DTLS connection is established, the client and server exchange information about which cipher suites they have in common. Refer to SBC for WRTC for more information on DTLS. The following crypto suites are supported.
Supported TLS/DTLS Crypto Suites
Authentication Mechanism | Public/Private Key Pair | Confidentiality Cipher and Mode | Integrity Cipher |
---|
RSA-WITH-NULL-SHA The integrity cipher used for the TLS Record protocol. | RSA | NULL | SHA-1 |
RSA-WITH-AES-128-CBC-SHA (default) Confidentiality cipher and mode for the TLS Record protocol. | RSA | AES-128-CBC | SHA-1 |
RSA-WITH-AES-128-CBC-SHA-256 Confidentiality cipher and mode for the TLS Record protocol with SHA-256 as the hash function. | RSA | AES-128-CBC | SHA-256 |
RSA-WITH-AES-256-CBC-SHA Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption. | RSA | AES-256-CBC | SHA-1 |
RSA-WITH-AES-256-CBC-SHA-256* Confidentiality cipher and mode for the TLS Record protocol with AES 256 encryption and SHA-256 as the hash function. | RSA | AES-256-CBC | SHA-256 |
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384** Confidentiality cipher and mode for the TLS Record with AES256 CBC and SHA384 as the hash function. | ECDH-ECDSA | AES-256-CBC | SHA-384 |
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384** Confidentiality cipher and mode for the TLS Record with AES256 GCM and SHA384 as the hash function. | ECDH-ECDSA | AES-256-GCM | SHA-384 |
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 CBC and SHA as the hash function. | ECDHE-RSA | AES-128-CBC | SHA-1 |
TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA-384* Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 CBC and SHA384 as the hash function. | ECDHE-RSA | AES-256-CBC | SHA-384 |
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES128 GCM and SHA as the hash function. | ECDHE-RSA | AES-128-GCM | SHA-256 |
TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA-384* Confidentiality cipher and mode for the TLS Record protocol using ECDHE (Elliptic Curve Diffie-Hellman key Exchange) with AES256 GCM and SHA384 as the hash function. | ECDHE-RSA | AES-256-GCM | SHA-384 |
TLS_RSA_WITH_AES_128_GCM_SHA256 Confidentiality cipher and mode for the TLS Record protocol with AES 128 GCM encryption and SHA-256 as the hash function. | RSA | AES_128_GCM | SHA256 |
TLS_RSA_WITH_AES_256_GCM_SHA384 Confidentiality cipher and mode for the TLS Record protocol with AES 256 GCM encryption and SHA-384 as the hash function. | RSA | AES_256_GCM | SHA384 |
* To use this cipher, TLS version 1.2 must be enabled in the TLS Profile.
** To use this cipher, TLS version 1.2 must be enabled in the TLS Profile and SSL certificates must be created using ECC keys.
Command Examples
> show profiles security tlsProfile defaultTlsProfile
appAuthTimer 5;
handshakeTimer 5;
sessionResumpTimer 3600;
cipherSuite1 rsa-with-aes-128-cbc-sha;
allowedRoles clientandserver;
v1_0 enabled;
v1_1 enabled;
v1_2 enabled;
% set profiles security tlsProfile defaultTlsProfile ocspProfileName myOcspProfile
% commit
> show profiles security tlsProfile defaultTlsProfile
appAuthTimer 5;
handshakeTimer 5;
sessionResumpTimer 3600;
cipherSuite1 rsa-with-aes-128-cbc-sha;
allowedRoles clientandserver;
ocspProfileName myOcspProfile;
v1_0 enabled;
v1_1 enabled;
v1_2 enabled;
% set profiles security tlsProfile TLS-1 v1_2 enabled
% set profiles security tlsProfile TLS-1 cipherSuite1 tls_ecdh_ecdsa_with_aes_256_gcm_sha384
% commit
> show profiles security tlsProfile TLS-1
cipherSuite1 tls_ecdh_ecdsa_with_aes_256_gcm_sha384;
v1_2 enabled;