SSL Version Level | Intel A31032-001 guide

A P P E N D I X C Intel® NetStructure™ 7110/7115 e-Commerce Accelerator User Guide

SSL Version Level

•SSLv2 - all SSL version 2.0 ciphers

•SSLv3 - all SSL version 3.0 ciphers

•SSLv2 and SSLv3 - all SSL version 2.0 and 3.0 ciphers

The default cipher value is all supported ciphers (both SSLv2 and

SSLv3).

The following table provides ciphers supported by the 7110/7115. Note that the export version of the software supports only the ciphers marked “E” in the Profile column.

Name	Protocol	Key	Authentication	Encryption	Message	Profile (Hi/
		Exchange		(key size)	Authentication	Medium/
						Low/
						Export)

DES-	SSLv3	RSA	RSA	3DES(168)	SHA1	H
DES-	SSLv3	RSA	RSA		SHA1	H
CBC3-
SHA

IDEA-	SSLv3	RSA	RSA	IDEA(128)	SHA1	M
IDEA-	SSLv3	RSA	RSA		SHA1	M
CBC-SHA

RC4-SHA	SSLv3	RSA	RSA	RC4(128)	SHA1	M

RC4-MD5	SSLv3	RSA	RSA	RC4(128)	MD5	M

DES-	SSLv3	RSA	RSA	DES(56)	SHA1	L
CBC-SHA

DES-	SSLv2	RSA	RSA	3DES(168)	MD5	H
CBC3-
MD5

IDEA-	SSLv2	RSA	RSA	IDEA(128)	MD5	M
CBC-
MD5

C-2

Image 164

Intel A31032-001 manual SSL Version Level

Contents

Intel NetStructure 7110/7115 e-Commerce Accelerator Version Copyright Trademarks Table of Contents Theory of Operation Scenarios Remote Management Alarms and Monitoring Troubleshooting Appendix a Front Panel List of Figures Xii Introduction About this User Guide New in This Release Remote Management Who Should Use this Book Before You Begin How to Use this Book Glossary defines terms appearing in this User Guide Page Installation and Initial Configuration Installing the 7110/7115 Free- Standing or in a Rack Rack Installation Free-Standing Installation Network Connections Admin Terminal Connection Status CheckNetwork and Server LEDs Inline LED HyperTerminal§ Paste Operations Server and Network LEDs TroubleshootingContinuing Configuration Single Server Acceleration Theory of OperationSecurity 7110/7115 in Single Server Configuration Multiple Servers Working with Internet Traffic Management ITM Devices Positioning 7110/7115 between ITM Device and Client Network Spilling and Throttling Positioning 7110/7115 between ITM Device and ServerScalability and Cascading Keys and Certificates Availability Cutting and Pasting with HyperTerminal§ Procedure Create a key Type the create key command at the promptCreate a Certificate Signing Request Intel 7115 create sign Asciix Enter Certificate REQUEST----- linesIntel 7115 export sign mywebserver Typically, the CSR will look something like this Enter Apache Interface to Open SSL§ modssl Save the configuration when the server has been mappedExporting a Key/Certificate from a Server Apache SSL§ Intel 7115 import key mywebserver Stronghold§Importing into the 7110/7115 Save the configuration when the server has been mapped Enter the create cert command with the keyID Creating a new Key/Certificate on the 7110/7115Create a key as follows Intel 7115 create cert mywebserver Global Site Certificates Overview Intel 7115 import cert keyID Global Site Certificate Paste ProcedureExample A P T E R Redirection Clients and Unsupported Ciphers Intel 7115 set redirect Client Authentication To disable a redirect URL for a mappingIntel 7115 show redirect Intel 7115 set redirect 2 none Intel 7115 show redirect Next, import the client CA certificate for Map ID Intel 7115 import clientca Generate a certificate signing request Creating a Client CA Certificate using OpenSSL§Generate the client CA certificate Automapping SSL ProcessingMapping Automapping with user-specified key and certificate Automapping with multiple port combinationsDeleting automapping entries Manual mapping Use the show block command to verify Combining automapping and manual mapping Use show block to verify Subnet IP, Specific PortAll IPs, Specific Port Intel 7115 delete block Use the show block command to confirm the blockDelete a Block Failure Conditions, Fail-safe, and Fail-through Scenarios Syntax Scenario 1-Single Server Procedure for ScenarioManual Configuration Intel 7115delete map 1 Intel 7115list maps This scenario shows how to configure two or more servers Scenario 2-Multiple Servers ID KeyID Scenario 3-Multiple 7110/ 7115s, Cascaded Assumptions Intel 7115 export config Multiple Cascaded 7110/7115s After verification y or refusal n, the prompt reappears Save the configurationIntel 7115 import config To reverse this process Intel 7115set egressmac none Command Reference Online Help Command Line Interface User AuthenticationCommand Line Prompt Abbreviation to Uniqueness A P T E R Command Line Interface Moving the Insertion Point Input Editing CommandsCommand History Cut and Paste Command Summary Inline List Command Command Options ImportNic Password Reboot Command Command Options Set Command Command Options Show Setsnmp ShowsnmpStatus Ttychar Status Command Command ReferenceHelp Commands SSL Commands Command Description Create keyDelete key Import key List keys Command Description Export keyShow key Command Description Create cert Delete certImport cert Export cert Command Description Show cert Display the expanded certificate including PEM formatDisplays all certificates Set ciphers Show clientca Command Description Set redirectShow redirect Create sign Command Description Import clientcaDelete clientca Show sign keyID Command Description Delete signExport sign Command Description Set defcert Issuer e-mail address. You can change all, some or noneDisplay the default certificate creation information Field Command Description Set kstrength Show kstrengthSet clienttmo Show clienttmo Command Description Set servertmo Displays the currently specified server timeout valueClient request is rejected Show servertmo Port Mapping Commands Command Definition Create blockDelete block Show block Show permit Command Definition Create permitDelete permit Command Definition Create map Delete map mapIDShow map List maps Inline Operational CommandsCommand Description Bypass Command Description Set spill Show spill Maxremotesessions Remote Management CommandsCommand Description Set ip Set telnetport Command Description Set telnetShow telnet Command Description Show telnetport Set sshShow ssh Set sshport Setsnmp snmpinfo Command Description Setsnmp snmpShowsnmp snmp Delete Snmp community strings CommandDescriptionSnmpcommunity List trapcommunity Command Description Setsnmp trapauthenTrapcommunity Delete trapcommunity Delete Snmp trap community strings Intel 7115 delete trapcommunity Alarms and Monitoring Commands Command Description Set alarmsShow alarms Set rscwindow Set utlhighwater Command Description Show rscwindowSet utlwindow Command Description Set utllowwater Show utlwindowShow utlhighwater Show utllowwater CommandDescription Show ovlwindow Intel 7115 show ovlwindow Display current volatile configuration settings Configuration CommandsCommand Description Show config Intel 7115 show config default Default configuration Command Description Config compare Config resetConfig default Config save Command Description Export config Configuration specifics are displayedImport config Import a configuration file paste, xmodem, uudecode List system Command Description Import upgradeImport patch Command Description Factorydefault Returns to factory configuration settings Administration Commands Command Description PasswordShow info Set date Command Description Set egressmac Set etherShow ether Set idleto Command Description Set more NicSet prompt Set serial Logging Commands Command Description Show serialCommand Description Exit Command Description Delete log Delete saved log/trace files from /flash/logsAll deletes all logs List logs Remote Management Overview Remote Management CLI Commands Limitations A P T E R Overview Remote Telnet Sessions Local Serial Console Remote Console, Telnet Changing the Telnet PortTo display the Telnet port Unix-prompttelnet To verify Telnet disable Enable remote SSh sessionsRemote SSh Sessions Disabling Telnet Unix-promptssh -1 admin PasswordpasswordRemote Console, SSh Changing the SSh Port To verify SSh disable Intel 7115 set ssh disableDisabling SSh To display the SSh port Standards Compliance Intel MIB Tree Where to find MIB Files Supported MIBsManagement Information Base-II MIB-II Intel Enterprise MIBs Ceo-header.my Enterprise Private MIB Summary Following is a summary of the 7110/7115 private MIBPage Snmp ThrottlesPerSec Number of throttles per second Snmp Private Traps in ssl-appliance-mib.my Trap SummaryStandard Snmp Traps Enabling Snmp Intel 7115 setsnmp snmp enable Intel 7115 showsnmp snmpIntel 7115 setsnmp snmp disable Intel 7115 showsnmp snmp Specifying Snmp Information Intel 7115 showsnmp snmpinfo Community String Intel 7115 delete snmpcommunity Use CLI commands, setsnmp trapcommunity, list Trap Community String Access Control Page Alarms Monitoring CLI commands for alarm configuration are Set alarms All, esc, rsc, utl, ovl, nls None Show alarms Alarm Types ESC Encryption Status Change AlarmAlarm Modifiers and Messages For example RSC Alarm CLI Commands To set Overload Alarm time windowRSC Refused SSL Connections Extended Data UTL Utilization Threshold Alarm To display Overload Alarm time windowThis alarm monitors three utilization threshold values Intel 7115 set rscwindow Intel 7115 show rscwindow UTL Alarm CLI commands To set Utilization Threshold Alarm time windowTo set Utilization Threshold Alarm high-water value To set Utilization Threshold Alarm low-water value OVL Overload Alarm OVL Alarm CLI CommandsIntel 7115 set ovlwindow seconds Range Intel 7115 set ovlwindow Intel 7115 show ovlwindow Alarm Logging NLS Network Link Status Alarm Intel 7115 status Respend Inline Ip 10.1.11.34 netmask Example, status alarms command Intel 7115 status alarms Report Configuration MonitoringMonitoring Reports Monitor report format Monitoring Reports CLI Commands Intel 7115 set monitoringfields Intel 7115 set monitoring enable Intel 7115 show monitoring Intel 7115 show monitoringfieldsPage Software Updates Intel 7115 import upgrade Using Windows§ HyperTerminal§Press y for yes at the Continue with upgrade? prompt Command import patch Connect the serial cable to the 7110/7115 auxiliary console To send the uuencoded file use the ~ command Intel 7115import upgrade Intel 7115import patch Page Troubleshooting Intel 7115 set clienttmo Error message Intermediate See Global Site Certificates Error message Server SettingsThen use the nic command to force Different media Front Panel LEDs Buttons and Switches Press to physically force bypass mode bypass 7110/7115Front Panel LEDs Processing See Appendix B, Failure Overload Connectors Enable 7110/7115 processing Failure/Bypass Modes Fail-through Switch Security Level Bypass Button P E N D I X B Fail-through Switch Security Level Page Supported Ciphers Cipher Strength SSL Version Level RC2 SSLv2 RC2128RC4-64 SSLv2 RC464Page Regulatory Information Taiwan Class a EMI Statement Vcci Statement FCC Part 15 Compliance Statement Canada Compliance Statement Industry Canada CE Compliance Statement Cispr 22 Statement Vcci Class a Japan Australia Avertissement Warnung Advertencias Wichtige Sicherheitshinweise Wichtige Sicherheitshinweise Page Terms and Conditions and Software License END User Terms and Conditions of Sale and Software LicensePage P E N D I X E Page Year warranty Process of being installed Export Law Regulations Page Glossary Glossary-2 Glossary-3 Glossary-4 Support Services Worldwide Access to Technical SupportNorth America only Japan only Support-2 Intel NetStructure 7110/7115 e-Commerce Accelerator User Support-4 Index D E Index-3 Index-4