3-15
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter3 Setting Up the Sensor
Changing Web Server Settings
Step 8
Press Enter to apply the changes or enter
no
to discard them.
Changing Web Server Settings
Note
The default web server port is 443 if TLS is enabled and 80 if TLS is disabled.
After you run the setup command, you can change the following web server settings: the web server port,
whether TLS encryption is being used, the HTTP server heade r message, restriction of TLS client
ciphers, web session inactivity timeout, and logging of web session inactivity timeouts.
HTTP is the protocol that web clients use to make requests from web servers. The HTTP specification
requires a server to identify itself in each response. Attackers sometimes exploit this protocol feature to
perform reconnaissance. If the IPS web server identified itself by providing a predictable response, an
attacker might learn that an IPS sensor is present.
We recommend that you not reveal to attackers that you have an IPS sensor. Change the server-id to
anything that does not reveal any information, especially if your web server is available to the Internet.
For example, if you forward a port through a firewall so you can monitor a sensor remotely, you need to
set the server-id.
The following options apply:
•
enable-tls {false | true}—Enables encryption (TLSv1) on the system. The default is enabled.
•
enable-websession-inactivity-timeout-logging {false | true}—Enables logging for web session
inactivity timeouts. The default is disabled.
•
port port_number—Specifies the port on which the web server listens for connections. The valid
range is 1 to 65535. The default is 443.
•
server-id server_id—Specifies the textual message the web server returns in the HTTP Server
header. The default is HTTP/1.1 compliant configurable-service.
•
tls-client-ciphers-restriction {false | true}—Enables the client to use only restricte d mode ciphers;
disabling allows all ciphers. The default is enabled. When IPS acts as a TLS client, you can
configure restriciton on the TLS ciphers.
Note
Changes take place for the next sessions only. The current web session is not affected.
When enabled, the client can use the following restricted ciphers:
–
TLS_RSA_WITH_AES_128_CBC_SHA
–
TLS_RSA_WITH_AES_256_CBC_SHA
–
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
–
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
When disabled, the client can use the following ciphers:
–
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
–
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
–
TLS_DHE_RSA_WITH_AES_256_CBC_SHA