Getting Started Guide vA5(1.0), Cisco ACE 4700 Series Application Control Engine Appliance - Configuring SSL Security [Cisco ACE 4700 Series Application Control Engine Appliances]

Table Of Contents

Configuring SSL Security

Information About SSL

Licensing Requirements for SSL

Prerequisites for Configuring SSL

Configuring SSL Termination

Configuring the ACE for SSL Termination Using the Device Manager GUI

Configuring the ACE for SSL Termination Using the CLI

Configuration Example for SSL Termination

Where to Go Next

Configuring SSL Security

This chapter describes how to configure SSL on the Cisco 4700 Series Application Control Engine (ACE) appliance. It describes how to configure the ACE for SSL termination.

This chapter contains the following sections:

•Information About SSL

•Licensing Requirements for SSL

•Prerequisites for Configuring SSL

•Configuring SSL Termination

•Configuration Example for SSL Termination

•Where to Go Next

Information About SSL

After reading this chapter, you should have a basic understanding of how the ACE appliance provides SSL security for your network and how to configure SSL termination, in which the ACE operates as an SSL server.

SSL configuration in an ACE establishes and maintains a SSL session between the ACE and another device. It provides for secure data transactions between a client and a server. SSL provides authentication, encryption, and data integrity in a Public Key Infrastructure (PKI), a set of policies and procedures that establishes a secure information exchange between devices.

In SSL, data is encrypted using one or more symmetric keys that are known only by the two endpoints in the transaction. In a key exchange, one device generates the symmetric key and then encrypts it using an asymmetric encryption scheme before transmitting the key to the other device.

Asymmetric encryption requires each device to have a unique key pair consisting of a public key and a private key. A private key is an encryption/decryption key known only to the parties exchanging the messages. A public key is a value provided by some designated authority as an encryption key that, combined with a private key derived from the public key, can be used to effectively encrypt messages and digital signatures. The two keys are mathematically related; data that is encrypted using the public key can only be decrypted using the corresponding private key, and vice versa.

SSL facilitates client and server authentication through the use of digital certificates. Digital certificates are a form of digital identification to prove the identity of the server to the client, or optionally, the client to the server. A certificate ensures that the identification information is correct and the public key embedded in it actually belongs to the client or server.

A Certificate Authority (CA) issues digital certificates in the context of a PKI. CAs are trusted authorities that sign certificates to verify their authenticity. As the certificate issuer, the CA uses its private key to sign the certificate. Upon receiving a certificate, a client uses the issuer's public key to decrypt and verify the certificate signature to ensure that the certificate was actually issued and signed by an authorized entity.

If you do not have a certificate and the corresponding key pair, you can use the ACE to generate a key pair and a certificate signing request (CSR) to apply for a certificate from a CA. The CA signs the CSR and returns the authorized digital certificate to you. The ACE supports import, export, and other management functions to manage the various certificates and key pair files within each context.

The client and server use the SSL handshake protocol to establish an SSL session between the two devices. During the handshake, the client and server negotiate the SSL parameters that they will use during the secure session. During the SSL handshake, the ACE uses an SSL proxy service, which includes the configuration of SSL session parameters, an RSA key pair, and a matching certificate.

The ACE applies SSL session parameters to an SSL proxy service. Creating an SSL parameter map allows you to apply the same SSL session parameters to different proxy services. The SSL session parameters include timeouts, close protocol behavior, and SSL version—SSL 3 and/or Transport Layer Security (TLS) 1. For more information on these parameters, see the SSL Guide, Cisco ACE Application Control Engine.

You can configure the ACE to act as a client or a server during an SSL session by defining operational attributes such as SSL session parameters, SSL key pairs and certificates, and traffic characteristics. When the traffic characteristics match the settings specified in the operational attributes, the ACE executes the actions associated with the SSL proxy service. Figure 9-1 shows the three basic SSL configurations in which the ACE is used to encrypt and decrypt data between the client and the server: SSL termination, SSL initiation, and end-to-end SSL.

Figure 9-1 ACE SSL Configurations

In SSL termination, an ACE context is configured for a front-end application in which the ACE operates as an SSL server that communicates with a client. When you define the flow between an ACE and a client, the ACE operates as a virtual SSL server by adding security services between a web browser (the client) and the HTTP connection (the server).

All inbound SSL flows that come from a client terminate at the ACE. After the connection is terminated, the ACE decrypts the ciphertext (encrypted content) from the client and sends the data as clear text (unencrypted content) to an HTTP server. For information about configuring the ACE for SSL termination, see the "Configuring SSL Termination" section.

In SSL initiation, an ACE context is configured for a back-end application in which the ACE operates as a client that communicates with an SSL server. When you define the flow between an ACE and an SSL server, the ACE operates as a client and initiates the SSL session. SSL initiation enables the ACE to receive clear text from a client and then establish an SSL session with an SSL server, joining the client and SSL server connections.

The ACE encrypts the clear text that it receives from the client and sends the data as ciphertext to an SSL server. The SSL server can either be an ACE configured for SSL termination (a virtual SSL server) or a real SSL server (web server). On the outbound flow from the SSL server, the ACE decrypts the ciphertext from the server and sends clear text back to the client. For more information on configuring the ACE for SSL initiation, see the SSL Guide, Cisco ACE Application Control Engine.

In end-to-end SSL, an ACE context is configured for both SSL termination and SSL initiation. You configure the ACE for end-to-end SSL when you have an application that requires secure SSL channels between the client and the ACE, and between the ACE and the SSL server.

For example, a transaction between banks requires end-to-end SSL to protect all financial information exchanged. End-to-end SSL also allows the ACE to insert load-balancing and security information into the data. The ACE decrypts the ciphertext that it receives and inserts load-balancing and firewall information into the clear text. The ACE then re-encrypts the data and passes the ciphertext to its intended destination.

SSL termination occurs when the ACE, acting as an SSL proxy server, terminates an SSL connection from a client and then establishes a TCP connection to an HTTP server. When the ACE terminates the SSL connection, it decrypts the ciphertext from the client and transmits the data as clear text to the HTTP server.

Figure 9-2 shows the following network connections in which the ACE terminates the SSL connection with the client:

•Client to ACE—An SSL connection exists between the client and the ACE acting as an SSL proxy server.

•ACE to Server—A TCP connection exists between the ACE and the HTTP server.

Figure 9-2 SSL Termination

Before configuring the ACE for an SSL operation, you must first configure it for server load balancing. To configure your ACE for server load balancing, see Chapter , "Configuring Server Load Balancing"

SSL termination is a Layer 3 and Layer 4 application because it is based on the destination IP address of the inbound traffic flow from the client. When configuring a policy map for SSL termination, you associate the following elements:

•The SSL proxy service, including SSL session parameters, certificate, and key pair.

•The virtual SSL server IP address that the destination IP address of the inbound traffic must match (a class map). When a match occurs, the ACE negotiates with the client to establish an SSL connection.

You can configure the ACE for SSL termination by following these steps:

Step 1 Import a key file with a key pair.

Step 2 Import a certificate that matches the imported key pair.

Step 3 Configure a parameter map.

Step 4 Configure an SSL proxy service using the key pair, certificate, and parameter map.

Step 5 Create a virtual server for SSL termination using the SSL proxy service.

Step 6 Deploy the configuration.

For more information on configuring the ACE for end-to-end SSL initiation, see the Cisco 4700 Application Control Engine Series Appliance SSL Configuration Guide.

Licensing Requirements for SSL

By default, the ACE module provides 1000 SSL transactions per second (TPS) and the ACE appliance provides 100 TPS. To increase the SSL transactions per second for either the ACE module or ACE appliance, you must obtain an optional bundle license from Cisco.

For details about licensing, see the Administration Guide, Cisco ACE Application Control Engine.

Prerequisites for Configuring SSL

Before configuring the ACE for an SSL operation, you must first configure it for server load balancing. To configure your ACE for server load balancing, see Chapter , "Configuring Server Load Balancing"

Before you configure SSL termination using the procedure in this chapter, you should have a signed SSL certificate and a key pair residing on an FTP server. For details about obtaining an SSL certificate and key pair, see the SSL Guide, Cisco ACE Application Control Engine.

If you do not have your own SSL certificate and key pair, for internal testing only, you can use the following Cisco-provided self-signed sample certificate and key pair files as follows:

•cisco-sample-cert

•cisco-sample-key

Configuring SSL Termination

To configure SSL termination, you can use either the ACE Device Manager user interface (GUI) or the CLI.

•Configuring the ACE for SSL Termination Using the Device Manager GUI

•Configuring the ACE for SSL Termination Using the CLI

Configuring the ACE for SSL Termination Using the Device Manager GUI

You can configure the ACE for SSL termination using the Device Manager GUI by following these steps:

Step 1 Choose the user context VC_web, and then choose SSL > Setup Sequence. The Setup Sequence window appears.

Step 2 Click Import SSL Key Pair to import a key file. The Import SSL Key Pair pane appears at the bottom of the SSL Setup Sequence window.

Step 3 Enter the following parameters. Leave the remaining parameters blank or with their default values.

•Protocol: FTP

•IP Address: 172.25.91.100 (in order for this to work, you should use an IP address where you can access the remote key file)

•Remote File Name: C:\marketing.pem

•Local File Name: C:\marketing.pem

•User Name: Admin

•Password: (password for your FTP server)

•Confirm: (retype the password for your FTP server)

Step 4 Click Import to import the key file.

Step 5 Choose Import Certificates in the SSL Setup Sequence window. The Import Certificates pane appears.

Step 6 Enter the following parameters. Leave the remaining parameters blank or with their default values.

•Protocol: FTP

•IP Address: 172.25.91.100 (in order for this to work, you should use an IP address where you can access the certificate file)

•Remote File Name: C:\marketing_cert.pem

•Local File Name: C:\marketing_cert.pem

•User Name: Admin

•Password: (password for your FTP server)

•Confirm: (retype the password for your FTP server)

Step 7 Click OK to import the certificate file.

Step 8 Choose SSL > Parameter Maps. The Parameter Maps pane appears.

Step 9 Click Add (+) to create a parameter map. The Parameter Map window appears.

Step 10 Enter PM_SSL_termination in the Name field. Leave the remaining parameters blank or with their default values.

Step 11 Click Deploy Now to deploy the parameter map on the ACE appliance. The Parameter Map Cipher pane appears.

Step 12 Select Add in the Parameter Map Cipher pane.

Step 13 Accept the defaults and click Deploy Now in the Parameter Map Cipher pane to add a cipher to the parameter map.

Step 14 Create an SSL proxy service by choosing SSL > Proxy Service. The Proxy Service pane appears.

Step 15 Click Add (+) to create a proxy service. The Proxy Service window appears.

Step 16 Enter the following parameters. Leave the remaining parameters blank or with their default values.

•Name: PS_SSL_termination

•Keys: (choose the key file that you imported earlier)

•Certificates: (choose the certificate that you imported earlier)

•Parameter Maps: PM_SSL_termination

Step 17 Click Deploy Now to deploy the proxy service on the ACE appliance.

Step 18 Configure a virtual server for SSL termination by choosing Load Balancing > Virtual Servers. The Virtual Servers pane appears.

Step 19 Click Add (+) to create a virtual server. The Add Virtual Server window appears.

Step 20 Enter the following parameters. Leave the remaining parameters blank or with their default values.

•Virtual Server Name: VIP_SSL

•Virtual IP Address: 10.10.40.11

•Transport Protocol: TCP

•Application Protocol: HTTPS

•Port: 443

•VLAN: 400

•Proxy Service Name: PS_SSL_termination

•Primary Action: Load Balance

•Server Farm: SF_web

Step 21 Click Deploy Now to deploy the virtual SSL server on the ACE appliance.

Configuring the ACE for SSL Termination Using the CLI

You can configure the ACE for SSL termination using the CLI by following these steps:

Step 1 Verify that you are operating in the desired context, by checking the CLI prompt. If necessary, change to the correct context.
host1/Admin# changeto VC_web
host1/VC_web#
Step 2 Import the key file marketing.pem from an FTP server.
host1/VC_web# crypto import ftp 172.25.91.100 Admin /marketing.pem marketing.pem 
Password: ****
Passive mode on.
Hash mark printing on (1024 bytes/hash mark).
#
Successfully imported file from remote server.
host1/VC_web# 
Step 3 Copy the certificate information from the certificate you received from the CA, and paste it into a certificate file called marketing_cert.pem.
host1/VC_web# crypto import terminal marketing_cert.pem
Enter PEM formatted data ending with a blank line or "quit" on a line by itself.
-----------BEGIN CERTIFICATE----------------------------------------
MIIC1DCCAj2gAwIBAgIDCCQAMA0GCSqGSIb3DQEBAgUAMIHEMQswCQYDVQQGEwJa
QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xHTAb
BgNVBAoTFFRoYXd0ZSBDb25zdWx0aW5nIGNjMSgwJgYDVQQLEx9DZXJ0aWZpY2F0
aW9uIFNlcnZpY2VzIERpdmlzaW9uMRkwFwYDVQQDExBUaGF3dGUgU2VydmVyIENB
MSYwJAYJKoZIhvcNAQkBFhdzZXJ2ZXItY2VydHNAdGhhd3RlLmNvbTAeFw0wMTA3
-----------END CERTIFICATE------------------------------------------
Step 4 Enter quit to close the file.
quit
host1/VC_web#
Step 5 Verify that the certificate matches the key pair.
host1/VC_web# crypto verify marketing.pem marketing_cert.pem
keypair in marketing.pem matches certificate in marketing_cert.pem
Step 6 Start configuring SSL termination by entering configuration mode.
host1/VC_web# config
host1/VC_web(config)#
Step 7 Create an SSL proxy service.
host1/VC_web(config)# ssl-proxy service PS_SSL_termination
host1/VC_web(config-ssl-proxy)#
Step 8 Configure the SSL proxy service by defining the key pair and corresponding certificate.
host1/VC_web(config-ssl-proxy)# key marketing
host1/VC_web(config-ssl-proxy)# cert marketing_cert
host1/VC_web(config-ssl-proxy)# exit
host1/VC_web(config)#
Step 9 Create a Layer 3 and Layer 4 class map and configure it with the input traffic match criteria.
host1/VC_web(config)# class-map CM_SSL
host1/VC_web(config-cmap)# match virtual-address 10.10.40.11 tcp any
host1/VC_web(config-cmap)# exit
host1/VC_web(config)#
Step 10 Create a policy map and associate with it the class map CM_SSL.
host1/VC_web(config)# policy-map multi-match PM_SSL
host1/VC_web(config-pmap)# class CM_SSL
host1/VC_web(config-pmap-c)#
Step 11 Associate the SSL proxy service PS_SSL_termination with the policy map.
host1/VC_web(config-pmap-c)# ssl-proxy server PS_SSL_termination
host1/VC_web(config-pmap-c)# exit
host1/VC_web(config-pmap)# exit
host1/VC_web(config)#
Step 12 Apply the policy map to the input traffic of the VLAN 400 interface.
host1/VC_web(config)# interface vlan 400
host1/VC_web(config-if)# service-policy input PM_SSL 
Step 13 Display the running configuration to verify that the information that you just added is configured properly.
host1/VC_web(config-if)# do show running-config
Configuration Example for SSL Termination

The following example shows how to configure SSL termination. The commands that you have configured in this chapter appear in bold text.
switch/VC_web(config)# do show running config
Generating configuration....
access-list INBOUND line 8 extended permit ip any any
rserver host RS_WEB1
  description content server web-one
  ip address 10.10.50.10
  inservice
rserver host RS_WEB2
  description content server web-two
  ip address 10.10.50.11
  inservice
rserver host RS_WEB3
  description content server web-three
  ip address 10.10.50.12
  inservice
rserver host RS_WEB4
  description content server web-four
  ip address 10.10.50.13
  inservice
serverfarm host SF_WEB
  predictor hash header Accept
  rserver RS_WEB1 80
    inservice
  rserver RS_WEB2 80
    inservice
  rserver RS_WEB3 80
    inservice
  rserver RS_WEB4 80
    inservice
sticky http-cookie Cookie1 StickyGroup1
  timeout 3600
  serverfarm SF_WEB
ssl-proxy service PS_SSL_TERMINATION
  key cisco-sample-key
  cert cisco-sample-cert
class-map match-all CM_SSL
  2 match virtual-address 10.10.40.11 tcp eq https
class-map type management match-any REMOTE_ACCESS
  description Remote access traffic match
  2 match protocol ssh any
  3 match protocol telnet any
  4 match protocol icmp any
class-map match-all VS_WEB
  2 match virtual-address 10.10.40.10 tcp eq www
policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY
  class REMOTE_ACCESS
    permit
policy-map type loadbalance first-match PM_LB
  class class-default
    serverfarm SF_WEB
policy-map multi-match PM_MULTI_MATCH
  class VS_WEB
    loadbalance vip inservice
    loadbalance policy PM_LB
  class CM_SSL
    loadbalance vip inservice
    loadbalance policy PM_LB
    ssl-proxy server PS_SSL_TERMINATION
service-policy input REMOTE_MGMT_ALLOW_POLICY
interface vlan 400
  description Client connectivity on VLAN 400
  ip address 10.10.40.1 255.255.255.0
  access-group input INBOUND
  service-policy input PM_MULTI_MATCH
  no shutdown
interface vlan 500
  description Server connectivity on VLAN 500
  ip address 10.10.50.1 255.255.255.0
  no shutdown
domain DOMAIN1
add-object all
ip route 0.0.0.0 0.0.0.0 172.25.91.1
username USER1 password 5 $1$vAN9gQDI$MmbmjQgJPj45lxbtzXPpB1 role SLB-Admin domain DOMAIN1
Where to Go Next

In this chapter, you have configured a virtual server for SSL termination. In the next chapter, you will configure server health monitoring.

	Getting Started Guide vA5(1.0), Cisco ACE 4700 Series Application Control Engine Appliance
	Configuring SSL Security
Getting Started Guide vA5(1.0), Cisco ACE 4700 Series Application Control Engine Appliance Preface Overview Setting Up an ACE Appliance Creating a Virtual Context Configuring Access Control Lists Configuring Role-Based Access Control Configuring Server Load Balancing Configuring a Load-Balancing Predictor Configuring Server Persistence Using Stickiness Configuring SSL Security Configuring Health Monitoring Using Health Probes Configuring Redundant ACEs Configuring Bridged Mode Configuring One-Arm Mode Index	Download this chapter Configuring SSL Security Download the complete book Getting Started Guide v 5.1(0), Cisco ACE 4700 Series Application Control Engine Appliance (Book-Length PDF) (PDF - 1 MB) Feedback Table Of Contents Configuring SSL Security Information About SSL Licensing Requirements for SSL Prerequisites for Configuring SSL Configuring SSL Termination Configuring the ACE for SSL Termination Using the Device Manager GUI Configuring the ACE for SSL Termination Using the CLI Configuration Example for SSL Termination Where to Go Next Configuring SSL Security This chapter describes how to configure SSL on the Cisco 4700 Series Application Control Engine (ACE) appliance. It describes how to configure the ACE for SSL termination. This chapter contains the following sections: •Information About SSL •Licensing Requirements for SSL •Prerequisites for Configuring SSL •Configuring SSL Termination •Configuration Example for SSL Termination •Where to Go Next Information About SSL After reading this chapter, you should have a basic understanding of how the ACE appliance provides SSL security for your network and how to configure SSL termination, in which the ACE operates as an SSL server. SSL configuration in an ACE establishes and maintains a SSL session between the ACE and another device. It provides for secure data transactions between a client and a server. SSL provides authentication, encryption, and data integrity in a Public Key Infrastructure (PKI), a set of policies and procedures that establishes a secure information exchange between devices. In SSL, data is encrypted using one or more symmetric keys that are known only by the two endpoints in the transaction. In a key exchange, one device generates the symmetric key and then encrypts it using an asymmetric encryption scheme before transmitting the key to the other device. Asymmetric encryption requires each device to have a unique key pair consisting of a public key and a private key. A private key is an encryption/decryption key known only to the parties exchanging the messages. A public key is a value provided by some designated authority as an encryption key that, combined with a private key derived from the public key, can be used to effectively encrypt messages and digital signatures. The two keys are mathematically related; data that is encrypted using the public key can only be decrypted using the corresponding private key, and vice versa. SSL facilitates client and server authentication through the use of digital certificates. Digital certificates are a form of digital identification to prove the identity of the server to the client, or optionally, the client to the server. A certificate ensures that the identification information is correct and the public key embedded in it actually belongs to the client or server. A Certificate Authority (CA) issues digital certificates in the context of a PKI. CAs are trusted authorities that sign certificates to verify their authenticity. As the certificate issuer, the CA uses its private key to sign the certificate. Upon receiving a certificate, a client uses the issuer's public key to decrypt and verify the certificate signature to ensure that the certificate was actually issued and signed by an authorized entity. If you do not have a certificate and the corresponding key pair, you can use the ACE to generate a key pair and a certificate signing request (CSR) to apply for a certificate from a CA. The CA signs the CSR and returns the authorized digital certificate to you. The ACE supports import, export, and other management functions to manage the various certificates and key pair files within each context. The client and server use the SSL handshake protocol to establish an SSL session between the two devices. During the handshake, the client and server negotiate the SSL parameters that they will use during the secure session. During the SSL handshake, the ACE uses an SSL proxy service, which includes the configuration of SSL session parameters, an RSA key pair, and a matching certificate. The ACE applies SSL session parameters to an SSL proxy service. Creating an SSL parameter map allows you to apply the same SSL session parameters to different proxy services. The SSL session parameters include timeouts, close protocol behavior, and SSL version—SSL 3 and/or Transport Layer Security (TLS) 1. For more information on these parameters, see the SSL Guide, Cisco ACE Application Control Engine. You can configure the ACE to act as a client or a server during an SSL session by defining operational attributes such as SSL session parameters, SSL key pairs and certificates, and traffic characteristics. When the traffic characteristics match the settings specified in the operational attributes, the ACE executes the actions associated with the SSL proxy service. Figure 9-1 shows the three basic SSL configurations in which the ACE is used to encrypt and decrypt data between the client and the server: SSL termination, SSL initiation, and end-to-end SSL. Figure 9-1 ACE SSL Configurations In SSL termination, an ACE context is configured for a front-end application in which the ACE operates as an SSL server that communicates with a client. When you define the flow between an ACE and a client, the ACE operates as a virtual SSL server by adding security services between a web browser (the client) and the HTTP connection (the server). All inbound SSL flows that come from a client terminate at the ACE. After the connection is terminated, the ACE decrypts the ciphertext (encrypted content) from the client and sends the data as clear text (unencrypted content) to an HTTP server. For information about configuring the ACE for SSL termination, see the "Configuring SSL Termination" section. In SSL initiation, an ACE context is configured for a back-end application in which the ACE operates as a client that communicates with an SSL server. When you define the flow between an ACE and an SSL server, the ACE operates as a client and initiates the SSL session. SSL initiation enables the ACE to receive clear text from a client and then establish an SSL session with an SSL server, joining the client and SSL server connections. The ACE encrypts the clear text that it receives from the client and sends the data as ciphertext to an SSL server. The SSL server can either be an ACE configured for SSL termination (a virtual SSL server) or a real SSL server (web server). On the outbound flow from the SSL server, the ACE decrypts the ciphertext from the server and sends clear text back to the client. For more information on configuring the ACE for SSL initiation, see the SSL Guide, Cisco ACE Application Control Engine. In end-to-end SSL, an ACE context is configured for both SSL termination and SSL initiation. You configure the ACE for end-to-end SSL when you have an application that requires secure SSL channels between the client and the ACE, and between the ACE and the SSL server. For example, a transaction between banks requires end-to-end SSL to protect all financial information exchanged. End-to-end SSL also allows the ACE to insert load-balancing and security information into the data. The ACE decrypts the ciphertext that it receives and inserts load-balancing and firewall information into the clear text. The ACE then re-encrypts the data and passes the ciphertext to its intended destination. SSL termination occurs when the ACE, acting as an SSL proxy server, terminates an SSL connection from a client and then establishes a TCP connection to an HTTP server. When the ACE terminates the SSL connection, it decrypts the ciphertext from the client and transmits the data as clear text to the HTTP server. Figure 9-2 shows the following network connections in which the ACE terminates the SSL connection with the client: •Client to ACE—An SSL connection exists between the client and the ACE acting as an SSL proxy server. •ACE to Server—A TCP connection exists between the ACE and the HTTP server. Figure 9-2 SSL Termination Before configuring the ACE for an SSL operation, you must first configure it for server load balancing. To configure your ACE for server load balancing, see Chapter , "Configuring Server Load Balancing" SSL termination is a Layer 3 and Layer 4 application because it is based on the destination IP address of the inbound traffic flow from the client. When configuring a policy map for SSL termination, you associate the following elements: •The SSL proxy service, including SSL session parameters, certificate, and key pair. •The virtual SSL server IP address that the destination IP address of the inbound traffic must match (a class map). When a match occurs, the ACE negotiates with the client to establish an SSL connection. You can configure the ACE for SSL termination by following these steps: Step 1 Import a key file with a key pair. Step 2 Import a certificate that matches the imported key pair. Step 3 Configure a parameter map. Step 4 Configure an SSL proxy service using the key pair, certificate, and parameter map. Step 5 Create a virtual server for SSL termination using the SSL proxy service. Step 6 Deploy the configuration. For more information on configuring the ACE for end-to-end SSL initiation, see the Cisco 4700 Application Control Engine Series Appliance SSL Configuration Guide. Licensing Requirements for SSL By default, the ACE module provides 1000 SSL transactions per second (TPS) and the ACE appliance provides 100 TPS. To increase the SSL transactions per second for either the ACE module or ACE appliance, you must obtain an optional bundle license from Cisco. For details about licensing, see the Administration Guide, Cisco ACE Application Control Engine. Prerequisites for Configuring SSL Before configuring the ACE for an SSL operation, you must first configure it for server load balancing. To configure your ACE for server load balancing, see Chapter , "Configuring Server Load Balancing" Before you configure SSL termination using the procedure in this chapter, you should have a signed SSL certificate and a key pair residing on an FTP server. For details about obtaining an SSL certificate and key pair, see the SSL Guide, Cisco ACE Application Control Engine. If you do not have your own SSL certificate and key pair, for internal testing only, you can use the following Cisco-provided self-signed sample certificate and key pair files as follows: •cisco-sample-cert •cisco-sample-key Configuring SSL Termination To configure SSL termination, you can use either the ACE Device Manager user interface (GUI) or the CLI. •Configuring the ACE for SSL Termination Using the Device Manager GUI •Configuring the ACE for SSL Termination Using the CLI Configuring the ACE for SSL Termination Using the Device Manager GUI You can configure the ACE for SSL termination using the Device Manager GUI by following these steps: Step 1 Choose the user context VC_web, and then choose SSL > Setup Sequence. The Setup Sequence window appears. Step 2 Click Import SSL Key Pair to import a key file. The Import SSL Key Pair pane appears at the bottom of the SSL Setup Sequence window. Step 3 Enter the following parameters. Leave the remaining parameters blank or with their default values. •Protocol: FTP •IP Address: 172.25.91.100 (in order for this to work, you should use an IP address where you can access the remote key file) •Remote File Name: C:\marketing.pem •Local File Name: C:\marketing.pem •User Name: Admin •Password: (password for your FTP server) •Confirm: (retype the password for your FTP server) Step 4 Click Import to import the key file. Step 5 Choose Import Certificates in the SSL Setup Sequence window. The Import Certificates pane appears. Step 6 Enter the following parameters. Leave the remaining parameters blank or with their default values. •Protocol: FTP •IP Address: 172.25.91.100 (in order for this to work, you should use an IP address where you can access the certificate file) •Remote File Name: C:\marketing_cert.pem •Local File Name: C:\marketing_cert.pem •User Name: Admin •Password: (password for your FTP server) •Confirm: (retype the password for your FTP server) Step 7 Click OK to import the certificate file. Step 8 Choose SSL > Parameter Maps. The Parameter Maps pane appears. Step 9 Click Add (+) to create a parameter map. The Parameter Map window appears. Step 10 Enter PM_SSL_termination in the Name field. Leave the remaining parameters blank or with their default values. Step 11 Click Deploy Now to deploy the parameter map on the ACE appliance. The Parameter Map Cipher pane appears. Step 12 Select Add in the Parameter Map Cipher pane. Step 13 Accept the defaults and click Deploy Now in the Parameter Map Cipher pane to add a cipher to the parameter map. Step 14 Create an SSL proxy service by choosing SSL > Proxy Service. The Proxy Service pane appears. Step 15 Click Add (+) to create a proxy service. The Proxy Service window appears. Step 16 Enter the following parameters. Leave the remaining parameters blank or with their default values. •Name: PS_SSL_termination •Keys: (choose the key file that you imported earlier) •Certificates: (choose the certificate that you imported earlier) •Parameter Maps: PM_SSL_termination Step 17 Click Deploy Now to deploy the proxy service on the ACE appliance. Step 18 Configure a virtual server for SSL termination by choosing Load Balancing > Virtual Servers. The Virtual Servers pane appears. Step 19 Click Add (+) to create a virtual server. The Add Virtual Server window appears. Step 20 Enter the following parameters. Leave the remaining parameters blank or with their default values. •Virtual Server Name: VIP_SSL •Virtual IP Address: 10.10.40.11 •Transport Protocol: TCP •Application Protocol: HTTPS •Port: 443 •VLAN: 400 •Proxy Service Name: PS_SSL_termination •Primary Action: Load Balance •Server Farm: SF_web Step 21 Click Deploy Now to deploy the virtual SSL server on the ACE appliance. Configuring the ACE for SSL Termination Using the CLI You can configure the ACE for SSL termination using the CLI by following these steps: Step 1 Verify that you are operating in the desired context, by checking the CLI prompt. If necessary, change to the correct context. host1/Admin# changeto VC_web host1/VC_web# Step 2 Import the key file marketing.pem from an FTP server. host1/VC_web# crypto import ftp 172.25.91.100 Admin /marketing.pem marketing.pem Password: ****** Passive mode on. Hash mark printing on (1024 bytes/hash mark). # Successfully imported file from remote server. host1/VC_web# Step 3 Copy the certificate information from the certificate you received from the CA, and paste it into a certificate file called marketing_cert.pem. host1/VC_web# crypto import terminal marketing_cert.pem Enter PEM formatted data ending with a blank line or "quit" on a line by itself. -----------BEGIN CERTIFICATE---------------------------------------- MIIC1DCCAj2gAwIBAgIDCCQAMA0GCSqGSIb3DQEBAgUAMIHEMQswCQYDVQQGEwJa QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xHTAb BgNVBAoTFFRoYXd0ZSBDb25zdWx0aW5nIGNjMSgwJgYDVQQLEx9DZXJ0aWZpY2F0 aW9uIFNlcnZpY2VzIERpdmlzaW9uMRkwFwYDVQQDExBUaGF3dGUgU2VydmVyIENB MSYwJAYJKoZIhvcNAQkBFhdzZXJ2ZXItY2VydHNAdGhhd3RlLmNvbTAeFw0wMTA3 -----------END CERTIFICATE------------------------------------------ Step 4 Enter quit to close the file. quit host1/VC_web# Step 5 Verify that the certificate matches the key pair. host1/VC_web# crypto verify marketing.pem marketing_cert.pem keypair in marketing.pem matches certificate in marketing_cert.pem Step 6 Start configuring SSL termination by entering configuration mode. host1/VC_web# config host1/VC_web(config)# Step 7 Create an SSL proxy service. host1/VC_web(config)# ssl-proxy service PS_SSL_termination host1/VC_web(config-ssl-proxy)# Step 8 Configure the SSL proxy service by defining the key pair and corresponding certificate. host1/VC_web(config-ssl-proxy)# key marketing host1/VC_web(config-ssl-proxy)# cert marketing_cert host1/VC_web(config-ssl-proxy)# exit host1/VC_web(config)# Step 9 Create a Layer 3 and Layer 4 class map and configure it with the input traffic match criteria. host1/VC_web(config)# class-map CM_SSL host1/VC_web(config-cmap)# match virtual-address 10.10.40.11 tcp any host1/VC_web(config-cmap)# exit host1/VC_web(config)# Step 10 Create a policy map and associate with it the class map CM_SSL. host1/VC_web(config)# policy-map multi-match PM_SSL host1/VC_web(config-pmap)# class CM_SSL host1/VC_web(config-pmap-c)# Step 11 Associate the SSL proxy service PS_SSL_termination with the policy map. host1/VC_web(config-pmap-c)# ssl-proxy server PS_SSL_termination host1/VC_web(config-pmap-c)# exit host1/VC_web(config-pmap)# exit host1/VC_web(config)# Step 12 Apply the policy map to the input traffic of the VLAN 400 interface. host1/VC_web(config)# interface vlan 400 host1/VC_web(config-if)# service-policy input PM_SSL Step 13 Display the running configuration to verify that the information that you just added is configured properly. host1/VC_web(config-if)# do show running-config Configuration Example for SSL Termination The following example shows how to configure SSL termination. The commands that you have configured in this chapter appear in bold text. switch/VC_web(config)# do show running config Generating configuration.... access-list INBOUND line 8 extended permit ip any any rserver host RS_WEB1 description content server web-one ip address 10.10.50.10 inservice rserver host RS_WEB2 description content server web-two ip address 10.10.50.11 inservice rserver host RS_WEB3 description content server web-three ip address 10.10.50.12 inservice rserver host RS_WEB4 description content server web-four ip address 10.10.50.13 inservice serverfarm host SF_WEB predictor hash header Accept rserver RS_WEB1 80 inservice rserver RS_WEB2 80 inservice rserver RS_WEB3 80 inservice rserver RS_WEB4 80 inservice sticky http-cookie Cookie1 StickyGroup1 timeout 3600 serverfarm SF_WEB ssl-proxy service PS_SSL_TERMINATION key cisco-sample-key cert cisco-sample-cert class-map match-all CM_SSL 2 match virtual-address 10.10.40.11 tcp eq https class-map type management match-any REMOTE_ACCESS description Remote access traffic match 2 match protocol ssh any 3 match protocol telnet any 4 match protocol icmp any class-map match-all VS_WEB 2 match virtual-address 10.10.40.10 tcp eq www policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY class REMOTE_ACCESS permit policy-map type loadbalance first-match PM_LB class class-default serverfarm SF_WEB policy-map multi-match PM_MULTI_MATCH class VS_WEB loadbalance vip inservice loadbalance policy PM_LB class CM_SSL loadbalance vip inservice loadbalance policy PM_LB ssl-proxy server PS_SSL_TERMINATION** service-policy input REMOTE_MGMT_ALLOW_POLICY interface vlan 400 description Client connectivity on VLAN 400 ip address 10.10.40.1 255.255.255.0 access-group input INBOUND service-policy input PM_MULTI_MATCH no shutdown interface vlan 500 description Server connectivity on VLAN 500 ip address 10.10.50.1 255.255.255.0 no shutdown domain DOMAIN1 add-object all ip route 0.0.0.0 0.0.0.0 172.25.91.1 username USER1 password 5 $1$vAN9gQDI$MmbmjQgJPj45lxbtzXPpB1 role SLB-Admin domain DOMAIN1 Where to Go Next In this chapter, you have configured a virtual server for SSL termination. In the next chapter, you will configure server health monitoring.
	Terms & Conditions \| Privacy Statement \| Cookie Policy \| Trademarks