Cisco Explorer 4700 Installationsanleitung PDF herunterladen (Seite 346)

9-20

Device Manager Guide, Cisco ACE 4700 Series Application Control Engine Appliance

OL-26645-02

Chapter 9 Configuring SSL

Configuring SSL Parameter Maps

the SSL negotiation process.The default value is 300 seconds (5 minutes), and can be adjusted from 0

(to indicate an infinite timeout, so that session IDs are removed from the cache only when the cache

becomes full), up to 72000 seconds (20 hours). Specifying 0 causes the ACE to implement a least

recently used (LRU) timeout policy. By disabling this option, the full SSL handshake occurs for each

new connection with the ACE.

Step 7 In the Reject Expired CRLs field, click the check box to specify whether expired CRLs can be used. If

checked, no expired CRLs are allowed.

Step 8 In the Close Protocol Behavior field, select the method to be used to close the SSL connection:

• Disabled—Indicates that the ACE appliance is to send a close-notify alert message to the SSL peer;

however, the SSL peer does not expect a close-notify alert before removing the session. Whether the

SSL peer sends a close-notify alert message or not, the session information is preserved, allowing

session resumption for future SSL connections.

• None—Indicates that the ACE appliance is not to send a close-notify alert message to the SSL peer,

nor does the ACE appliance expect a close-notify alert message from the peer. The ACE appliance

preserves the session information so that SSL resumption can be used for future SSL connections.

Step 9 In the SSL Version field, enter the version of SSL be to used during SSL communications:

• All—Indicates that the ACE appliance is to use both SSL v3 and TLS v1 in its communications with

peer ACE appliances.

• SSL3—Indicates that the ACE appliance is to use only SSL v3 in its communications with peer ACE

appliances.

• TLS1—Indicates that the ACE appliance is to use only TLS v1 in its communications with peer

ACE appliances.

• TLS1_1—Indicates that the ACE appliance is to use only TLS Version 1.1 in its communication

with peer ACE appliances.

• TLS1_2—Indicates that the ACE appliance is to use only TLS Version 1.2 in its communication

with peer ACE appliances.

• Upto_TLS1_1—Indicates all SSL versions upto TLS 1.1.

• Upto_TLS1_2—Indicates all SSL versions upto TLS 1.2.

Note For TLS1_1 and TLS1_2 SSL versions, only certain ‘Ciphers’ are supported as mentioned in the

tables below. If the user tries to configure any unsupported SSL version or unsupported Cipher,

an error message will be displayed.

Folowing tables shows the list of supported cipher suites for TLS1_1 and TLS1_2 in ACE”

Table 9-8 Cipher suites supported by TLS 1.1

Cipher Suite Name Cipher Suite Number

RSA_WITH_RC4_128_MD5 { 0x00,0x04 }

RSA_WITH_RC4_128_SHA { 0x00,0x05 }

RSA_WITH_DES_CBC_SHA { 0x00,0x09 }

RSA_WITH_3DES_EDE_CBC_SHA { 0x00,0x0A }

RSA_WITH_AES_128_CBC_SHA { 0x00,0x2F }

RSA_WITH_AES_256_CBC_SHA { 0x00,0x35 }

1 2 ... 341 342 343 344 345 346 347 348 349 350 351 ... 647 648

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco Explorer 4700 Installationsanleitung Seite 346

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Digitale Videorecorder (DVR) Cisco Explorer 4700