Table Of Contents
ACE SSL Initiation Configuration Prerequisites
SSL Initiation Configuration Quick Start
Creating and Defining an SSL Parameter Map
Defining the Close-Protocol Behavior
Defining the SSL and TLS Version
Creating and Defining an SSL Proxy Service
Associating an SSL Parameter Map with the SSL Proxy Client Service
Creating a Layer 7 Class Map for SSL Initiation
Creating a Layer 7 Policy Map for SSL Termination
Associating a Layer 7 Class Map with the Layer 7 Policy Map
Specifying Layer 7 SLB Policy Actions
Creating a Layer 3 and Layer 4 Class Map for SSL Initiation
Creating a Layer 3 and Layer 4 Policy Map for SSL Initiation
Creating a Layer 3 and Layer 4 Policy Map
Associating the Layer 3 and Layer 4 Class Map with the Policy Map
Associating a Layer 7 Policy Map with the Class Map
Applying the Policy Map to the VLANs
Applying the Policy Map Globally
Applying the Policy Map to a Specific VLAN
Example of an SSL Initiation Configuration
Configuring SSL Initiation
This chapter describes the steps required to configure a context on the Cisco Application Control Engine (ACE) module as an SSL client for SSL initiation.
This chapter contains the following major sections:
•
ACE SSL Initiation Configuration Prerequisites
•
•
•
•
•
•
•
•
Overview of SSL Initiation
SSL initiation occurs when an ACE, acting as an SSL proxy client, initiates and maintains an SSL connection between itself and an SSL server. In this particular application, the ACE receives clear text from an HTTP client, encrypts and transmits the data as ciphertext to the SSL server. On the reverse side, the ACE decrypts the ciphertext it receives from the SSL server and sends the data to the client as clear text.
Figure 4-1 illustrates the following network connections in which the ACE initiates the SSL connection with the SSL server:
•
•
Figure 4-1 SSL Initiation with an SSL Server
SSL initiation allows you to send clear text between devices within a site for maximum speed, while sending ciphertext through the Internet between sites or to an SSL server for maximum security. For each SSL server or ACE (acting as an SSL proxy server) to which you want to establish an SSL connection from a clear text connection, you must configure an SSL initiation policy service on the ACE that maps to that SSL server or other ACE.
Figure 4-2 illustrates an SSL initiation flow with another ACE configured for SSL termination. In this case, ACE B acts as a virtual front-end SSL server.
Figure 4-2 SSL Initiation with a Second ACE Running SSL Termination
The ACE uses a combination of parameter maps, SSL proxy services, and class maps to build the policy maps that determine the flow of information among the client, the ACE, and the SSL server. For SSL initiation, you configure the ACE so that it is recognized as an SSL client by an SSL server. To accomplish this, you configure the following policy map types:
•
•
The flow chart shown in Figure 4-3 provides a basic overview of the process required to build and apply the two types of policy maps the ACE uses for SSL initiation. The flow chart also illustrates how you associate the various components of the policy map configurations with each other.
Figure 4-3 Basic SSL Initiation Configuration Flow Diagram
ACE SSL Initiation Configuration Prerequisites
Before configuring your ACE for SSL operation, you must first configure it for server load balancing (SLB). During the SLB configuration process, you create the following configuration objects:
•
•
•
•
After configuring SLB, modify the existing SLB class maps and policy maps with the SSL configuration requirements described in this guide for SSL initiation.
To configure your ACE for SLB, refer to the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
SSL Initiation Configuration Quick Start
Table 4-1 provides a quick overview of the steps required to configure the ACE for SSL initiation. Each step includes the CLI command or a reference to the procedure required to complete the task. For a complete description of each feature and all the options associated with the CLI commands, see the sections following Table 4-1.
Note
Creating and Defining an SSL Parameter Map
An SSL parameter map defines the SSL session parameters that the ACE applies to an SSL proxy service. Creating an SSL parameter map allows you to apply the same SSL session parameters to different proxy services.Table 4-3 describes each of the SSL session parameters along with their default values.
Table 4-2 Default SSL Parameter Map Settings
Cipher suites
Defines the cipher suites the ACE supports during the SSL handshake (see Table 4-3 for a list of available cipher suites the ACE supports)
The ACE supports all of the available cipher suites
Close-protocol
Defines how the ACE executes close-notify messages
strict—The ACE sends a close-notify alert message to its peer when closing a session and expects to receive one back
Version
Defines the SSL and TLS versions the ACE supports during the SSL handshake
all—The ACE supports versions SSL3 and TLS1
Note
To create an SSL parameter map, use the parameter-map type ssl command in configuration mode.
The syntax of this command is:
parameter-map type ssl parammap_name
The parammap_name argument is the name of the SSL parameter map. Enter an unquoted alphanumeric string with a maximum of 64 characters.
For example, to create the SSL parameter map PARAMMAP_SSL, enter:
host1/Admin(config)# parameter-map type ssl PARAMMAP_SSLOnce you create an SSL proxy parameter map, the CLI enters SSL parameter map configuration mode.
host1/Admin(config-parammap-ssl)#If you exit out of the SSL parameter map configuration mode without defining any of the SSL parameter map attributes, the ACE configures the parameter map with the default values listed in Table 4-2.
To delete an existing SSL parameter map, enter:
host1/Admin(config)# no parameter-map type ssl PARAMMAP_SSLThis section contains the following procedures for defining the SSL parameter map attributes:
•
•
Adding a Cipher Suite
The SSL protocol supports a variety of different cryptographic algorithms, or ciphers, for use in operations such as:
•
•
•
Clients and servers may support different cipher suites, or sets of ciphers, depending on various factors, such as the version of SSL they support, company policies regarding acceptable encryption strength, and government restrictions on export of SSL-enabled software. Among its other functions, the SSL handshake protocol determines how the server and client negotiate which cipher suite they will use to authenticate each other, transmit certificates, and to establish session keys.
As shown in Figure 4-4, a cipher suite consists of the following three algorithms: key exchange algorithm, data encryption algorithm, and message authentication (hash) algorithm.
Figure 4-4 Cipher Suite Algorithms
Note
To define each of the cipher suites you want the ACE to support during a secure session, use the cipher command in ssl parameter-map configuration mode. The cipher suite that you choose depends on your environment and security requirements and must correlate to the certificates and keys that you have loaded on the ACE.
Note
The syntax of this command is:
cipher cipher_name [priority cipher_priority]
The keywords and arguments are:
•
•
•
For example, to add the cipher suite rsa_with _aes_128_cbc_sha and assign it a priority 2 level:
host1/Admin(config)# parameter-map type ssl PARAMMAP_SSLhost1/Admin(config-parammap-ssl)# cipher rsa_with_aes_128_cbc_sha priority 2Repeat the cipher command for each cipher suite you want to include in the SSL parameter map.
To delete a cipher suite from the SSL parameter map, enter:
host1/Admin(config-parammap-ssl)# no cipher rsa_with_aes_128_cbc_shaTable 4-3 lists the available cipher suites that the ACE supports and indicates which of the supported cipher suites are exportable from the ACE. The table also lists the authentication certificate and encryption key required by each cipher suite.
If you use the default setting in which the ACE supports all of the ciphers suites listed in Table 4-3, the ACE sends the cipher suites to its peer in the same order as they appear in the table, starting with RSA_WITH_RC4_128_MD5.
Caution
Defining the Close-Protocol Behavior
To configure how the ACE handles the sending of close-notify messages, use the close-protocol command in the ssl parameter-map configuration mode.
The syntax for this command is:
close-protocol {disabled | none | strict}
The keywords are:
•
•
•
For example, to set close-protocol to none, enter:
host1/Admin(config)# parameter-map type ssl PARAMMAP_SSLhost1/Admin(config-parammap-ssl)# close-protocol noneTo configure the close-protocol command with the default setting of strict, use the no form of the command.
host1/Admin(config-parammap-ssl)# no close-protocol noneDefining the SSL and TLS Version
To specify which version of security protocol the ACE supports during the SSL handshake with its peer, use the version command in SSL parameter map configuration mode.
The syntax of this command is:
version {all | ssl3 | tls1}
The keywords are:
•
•
•
For example, to specify SSL version 3.0 for the parameter map, enter:
host1/Admin(config)# parameter-map type ssl PARAMMAP_SSLhost1/Admin(config-parammap-ssl)# version ssl3To remove a security version from the SSL proxy parameter map, enter:
host1/Admin(config-parammap-ssl)# no version tlslCreating and Defining an SSL Proxy Service
The SSL proxy service defines the SSL parameter map the ACE uses during the SSL handshake. For SSL initiation, you configure the ACE with an SSL proxy client service as the ACE acts as an SSL client.
To create an SSL proxy client service, use the ssl- proxy service command in configuration mode.
The syntax of this command is:
ssl- proxy service pservice_name
The pservice_name argument is the name of the SSL proxy client service. Enter an unquoted alphanumeric string with a maximum of 64 characters.
For example, to create the SSL proxy client service PSERVICE_CLIENT, enter:
host1/Admin(config)# ssl-proxy service PSERVICE_CLIENTOnce you create an SSL proxy client service, the CLI enters into SSL proxy configuration mode.
host1/Admin(config-ssl-proxy)#To delete an existing SSL proxy client service, enter:
host1/Admin(config)# no ssl-proxy PSERVICE_CLIENTThis section contains the following procedures for configuring the SSL proxy client service:
•
Associating an SSL Parameter Map with the SSL Proxy Client Service
To associate an SSL parameter map with the SSL proxy client service, use the ssl advanced-options command in SSL proxy configuration mode.
The syntax of this command is:
ssl advanced-options parammap_name
The parammap_name argument represents the name of an existing SSL parameter map (see the "Creating and Defining an SSL Parameter Map" section). Enter an unquoted alphanumeric string with a maximum of 64 characters.
For example, to associate the parameter map PARAMMAP_SSL with the SSL proxy service, enter:
host1/Admin(config)# ssl-proxy service PSERVICE_CLIENThost1/Admin(config-ssl-proxy)# ssl advanced-options PARAMMAP_SSLTo remove the association of an SSL parameter map with the SSL proxy service, enter:
host1/Admin(config-ssl-proxy)# no ssl advanced-options PARAMMAP_SSLCreating a Layer 7 Class Map for SSL Initiation
The Layer 7 class map you associate with a policy map acts as a filter for traffic that matches the server load balancing (SLB) criteria that you specify. For SSL initiation, the match criteria is in the form of the following HTTP load balancing attributes:
•
•
•
•
To create a Layer 7 class map, use the class-map type http loadbalance command in configuration mode. For details on configuring a Layer 7 class map, refer to the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
Creating a Layer 7 Policy Map for SSL Termination
A Layer 7 policy map enables server load balancing on the ACE. This policy map contains an association with a Layer 7 class map and an SSL proxy client service. To use a Layer 7 SLB policy map, first create the policy map and define match statements and policy actions. Because Layer 7 policy maps are child policies, you must then associate a Layer 7 policy map with the appropriate Layer 3 and Layer 4 policy map to provide an entry point for Layer 7 SLB traffic classification. You cannot directly apply a Layer 7 policy map to an interface; you can apply only a Layer 3 and Layer 4 policy map to an interface or globally to all interfaces in a context.
This section contains the following procedures for creating a Layer 7 policy map for SSL termination:
•
•
•
Creating a Layer 7 Policy Map
To create a Layer 7 SLB policy map, use the policy-map command in configuration mode.
The syntax of this command is:
policy-map type loadbalance first-match map_name
The keywords and arguments are:
•
•
•
For example, to create the policy map L7SLBPOLICY, enter:
host1/Admin(config)# policy-map type loadbalance first-match L7SLBPOLICYOnce you create a Layer 7 policy map, the CLI enters policy map load balancing configuration mode.
host1/Admin(config-pmap-lb)#To delete an existing policy map, enter:
host1/Admin(config)# no policy-map L7SLBPOLICYAssociating a Layer 7 Class Map with the Layer 7 Policy Map
To associate a class map with the policy map, use the class command in policy map load balancing configuration mode.
The syntax of this command is:
class {name1 | class-default} [insert-before name2]
The keywords, arguments, and options are:
•
•
•
For example, to associate the class map L7SLBCLASS with the policy map, enter:
host1/Admin(config-pmap-lb)# class L7SLBCLASSOnce you associate a class map with the policy map, the CLI enters into policy map load balancing class configuration mode.
host1/Admin(config-pmap-lb-c)#The following example illustrates the use of the insert-before option to define the position of a class map in the policy map:
host1/Admin(config-pmap-lb)# class L7SLBCLASS insert-before HTTP_CLASShost1/Admin(config-pmap-lb-c)#The following example illustrates the use of the class class-default command:
host1/Admin(config-pmap-lb)# class class-defaulthost1/Admin(config-pmap-lb-c)#To remove the association of a class map with the policy map, enter:
(config-pmap-lb)# no class L7SLBCLASSSpecifying Layer 7 SLB Policy Actions
After you associate a Layer 7 SLB class map with a Layer 7 SLB policy map or specify inline match commands, you need to specify one or more of the following actions that the ACE should take when network traffic matches a class map or inline match command:
•
•
•
•
•
•
•
This section describes the process of associating an SSL proxy service with the policy map. For details on configuring additional policy actions, refer to the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
To associate an SSL proxy client service with the policy map, use the ssl-proxy command in policy map load balancing class configuration mode.
The syntax of this command is:
ssl-proxy client name
The name argument specifies the identifier of an existing SSL proxy client service. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to associate the SSL client proxy service PSERVICE_CLIENT with the class map, enter:
host1/Admin(config)# policy-map type loadbalance first-match L7SLBPOLICYhost1/Admin(config-pmap-lb)# class L7SLBCLASShost1/Admin(config-pmap-lb-c)# ssl-proxy client PSERVICE_CLIENTTo remove the association of the SSL client proxy service to the class map, enter:
host1/Admin(config-pmap-lb-c)# no ssl-proxy client PSERVICE_CLIENTCreating a Layer 3 and Layer 4 Class Map for SSL Initiation
The Layer 3 and Layer 4 class map you associate with a Layer 3 and Layer 4 policy map acts as a filter for traffic that matches the criteria you specify. For SSL initiation, you can define the match criteria based on one or more of the following traffic characteristics:
•
•
•
•
•
To create a Layer 3 and Layer 4 class map, use the class-map command in the configuration mode. For details on creating and configuring a Layer 3 and Layer 4 class map, refer to the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
Creating a Layer 3 and Layer 4 Policy Map for SSL Initiation
The Layer 3 and Layer 4 policy map you create for SSL initiation contains an association with the Layer 7 policy map that the ACE uses for load balancing. Because you can only apply a Layer 3 and Layer 4 policy map directly directly to a context interface, you need to associate the Layer 7 policy with the Layer 3 and Layer 4 policy map.
This section contains the following procedures for creating a Layer 3 and Layer 4 policy map for SSL initiation and then associating a class map, parameter map, and Layer 7 policy map with it:
•
•
•
Creating a Layer 3 and Layer 4 Policy Map
To create a Layer 3 and Layer 4 policy map, use the policy-map command in configuration mode.
The syntax of this command is:
policy-map multi-match policy_name
The policy_name argument represents the name you assign the policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to create the policy map L4SLBPOLICY, enter:
host1/Admin(config)# policy-map multi-match L4SLBPOLICYOnce you create a class map, the CLI enters into policy map configuration mode.
host1/Admin(config-pmap)#To delete an existing policy map, enter:
host1/Admin(config)# no policy-map L4SLBPOLICYFor information on associating an SSL class map with the policy map, proceed to the "Associating a Layer 7 Class Map with the Layer 7 Policy Map" section.
Associating the Layer 3 and Layer 4 Class Map with the Policy Map
To associate the Layer 3 and Layer 4 class map with the policy map, use the class command in policy map configuration mode.
The syntax of this command is:
class class-map
The class-map argument represents the name of an existing class map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to associate the class map L4SLBCLASS with the policy map, enter:
host1/Admin(config)# policy-map multi-match L4SLBPOLICYhost1/Admin(config-pmap)# class L4SLBCLASSOnce you associate a class map with the policy map, the CLI enters policy map class configuration mode.
host1/Admin(config-pmap-c)#To remove the association of a class map to the policy map, enter:
host1/Admin(config-pmap)# no class L4SLBCLASSAssociating a Layer 7 Policy Map with the Class Map
To associate a Layer 7 policy map with the Layer 3 and Layer 4 class map, use the loadbalance command in policy map class configuration mode. This association nests the Layer 7 policy map within the Layer 3 and Layer 4 policy map that the ACE applies directly to the traffic.
The syntax of this command is:
loadbalance policy policymap
The policy policymap argument represents the name of an existing Layer 7 policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to associate the Layer 7 policy map L7SLBPOLICY with the class map, enter:
host1/Admin(config)# policy-map multi-match L4SLBPOLICYhost1/Admin(config-pmap)# class L4SLBCLASShost1/Admin(config-pmap-c)# loadbalance policy L7SLBPOLICYTo remove the association of the Layer 7 policy map with the class map, enter:
host1/Admin(config-pmap-c)# no loadbalance policy L7SLBPOLICYApplying the Policy Map to the VLANs
This section describes how to apply the Layer 3 and Layer 4 policy map to the VLAN traffic. The ACE allows you to apply the policy globally to all VLANs within the current context or to a specific VLAN in the context.
This section contains the following procedures for applying the policy map to a VLAN:
•
•
Applying the Policy Map Globally
To globally apply the policy map to all of the VLANs in the context, use the service-policy command in configuration mode.
The syntax of this command is:
service-policy input policy_name
The policy_name argument represents the name of an existing policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to globally apply the policy map L4SLBPOLICY to all of the context VLANs, enter:
host1/Admin(config)# service-policy input L4SLBPOLICYTo globally remove a policy map from all VLANs, enter:
host1/Admin(config)# no service-policy input L4SLBPOLICYApplying the Policy Map to a Specific VLAN
To apply a. policy map to a specific VLAN interface, you must enter interface configuration mode using the interface command in configuration mode.
The syntax of this command is:
interface vlan vlan
The vlan argument represents the context VLAN number. Enter an integer from 2 to 4094.
For example, to enter into interface configuration mode for VLAN 10, enter:
host1/Admin(config)# interface vlan 10host1/Admin(config-if)#To apply the policy map to the interface, use the service-policy command in interface configuration mode.
The syntax of this command is:
service-policy input policy-name
The policy-name argument represents the name of an existing policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to apply the policy map L4SLBPOLICY to VLAN 10, enter:
host1/Admin(config)# interface vlan 10host1/Admin(config-if)# service-policy input L4SLBPOLICYTo remove the policy from the interface, enter:
host1/Admin(config-if)# no service-policy input L4SLBPOLICYExample of an SSL Initiation Configuration
access-list ANYONE line 10 extended permit tcp any anyparameter-map type ssl SSL_TERMcipher RSA_WITH_3DES_EDE_CBC_SHArserver host DC5-LNX1ip address 192.168.1.11inservicerserver host DC5-LNX2ip address 192.168.1.12inservicerserver host DC5-LNX3ip address 192.168.1.13inservicerserver host DC5-LNX4ip address 192.168.1.14inservicerserver host dc5-lnx5ip address 192.168.1.15inservicessl-proxy service SSL_PROXY1cert MYCERT.PEMssl advanced-options SSL_TERMserverfarm SERVERS5rserver DC5-LNX1inservicerserver DC5-LNX2inservicerserver DC5-LNX3inservicerserver DC5-LNX4inservicerserver DC5-LNX5inserviceclass-map type http loadbalance match-all URL_CLASS2 match http url /index.htmlclass-map type management match-any REMOTE-ACCESSdescription remote-access-traffic-match2 match protocol telnet any3 match protocol ssh any4 match protocol icmp anyclass-map match-all VIP-702 match virtual-address 172.16.22.70 anypolicy-map type loadbalance first-match POLICY1class URL-CLASSserverfarm SERVERS5ssl-proxy client SSL_PROXY1policy-map type loadbalance first-match SLB5-LOGICclass class-defaultserverfarm SERVERS5policy-map type management first-match REMOTE-MGMTclass REMOTE-ACCESSpermitpolicy-map multi-match CLIENT-VIPSclass VIP-70loadbalance vip inserviceloadbalance SLB5-LOGICinterface vlan 222description Client vlanip address 172.16.22.15 255.255.255.0access-group input ANYONEservice-policy input REMOTE-MGMTservice-policy input CLIENT-VIPSno shutdowninterface vlan 422description Servers vlanip address 192.168.1.1 255.255.255.0no shutdownip route 0.0.0.0 0.0.0.0 172.16.22.1username cisco password 5 $1$DLODpUTE$pzudNN.PTCWK.E45AsyCz/ role Admin domain default-domain
