Feedback
Table Of Contents
ACE SSL Termination Configuration Prerequisites
SSL Termination Configuration Quick Start
Creating and Defining an SSL Parameter Map
Continuing SSL Session Setup with Client Certificate Failures
Configuring the ACE to Ignore Authentication Failures Due to CDP Errors
Defining the Close-Protocol Behavior
Defining the SSL and TLS Versions
Configuring the SSL Queue Delay
Configuring the SSL Session Cache Timeout
Rejecting Expired CRL Client Certificates
Creating and Defining an SSL Proxy Service
Associating an SSL Parameter Map with the SSL Proxy Server Service
Specifying the Certificate Chain Group
Enabling Client Authentication
Using CRLs During Client Authentication
Configuring the Download Location for CRLs
Configuring Signature Verification on a CRL
Configuring a Default Domain Name
Configuring a Domain Name Search List
Configuring a Domain Name Server
Configuring SSL URL Rewrite and HTTP Header Insertion
Configuring HTTP Header Insertion of SSL Session Parameters
Configuring HTTP Header Insertion of SSL Server Certificate Information
Configuring HTTP Header Insertion of SSL Client Certificate Information
Associating an Action List with a Layer 7 HTTP Load-balancing Policy Map
Example Configurations Containing HTTP Header Insertion
Inserting SSL Session Information Into the First HTTP Request Only
Inserting SSL Session Information Into All HTTP Requests
Creating a Layer 3 and Layer 4 Class Map for SSL Termination
Creating a Layer 3 and Layer 4 Policy Map for SSL Termination
Creating a Layer 3 and Layer 4 Policy Map
Associating the Layer 3 and Layer 4 Class Map with the Policy Map
Associating an SSL Proxy Server Service with the Policy Map
Applying the Policy Map to the VLANs
Applying the Policy Map Globally
Applying the Policy Map to a Specific VLAN
Example of an SSL Termination Configuration
Configuring SSL Termination
This chapter describes the steps required to configure a context on the Cisco Application Control Engine (ACE) module as a virtual SbSL server for SSL termination. It contains the following major sections:
•
ACE SSL Termination Configuration Prerequisites
•
•
•
•
•
•
•
•
Note
SSL Termination Overview
SSL termination occurs when the ACE, acting as an SSL proxy server, terminates an SSL connection from a client and then establishes a TCP connection to an HTTP server. When the ACE terminates the SSL connection, it decrypts the ciphertext from the client and transmits the data as clear text to an HTTP server.
Figure 3-1 shows the following network connections in which the ACE terminates the SSL connection with the client:
•
•
Figure 3-1 SSL Termination with a Client
The ACE uses parameter maps, SSL proxy services, and class maps to build the policy maps that determine the flow of information between the client, the ACE, and the server. SSL termination is a Layer 3 and Layer 4 application because it is based on the destination IP addresses of the inbound traffic flow from the client. For this type of application, you create a Layer 3 and Layer 4 policy map that the ACE applies to the inbound traffic.
When configuring a policy map for SSL termination, you associate a parameter map and SSL proxy server service with the policy map to define the SSL session parameters and client/server authentication tools, such as the certificate and RSA key pair. You also associate a class map with the policy map to define the virtual SSL server IP addresses that the destination IP address of the inbound traffic must match. When a match occurs, the ACE negotiates with the client to establish an SSL connection. You can define a maximum of 250 virtual SSL servers for a single class map.
Figure 3-2 provides a basic overview of the process required to build and apply the Layer 3 and Layer 4 policy map that the ACE uses for SSL termination. The figure also shows how you associate the various components of the policy map configuration with each other.
Figure 3-2 Basic SSL Termination Configuration Flow Diagram
ACE SSL Termination Configuration Prerequisites
Before configuring your ACE for SSL operation, you must first configure it for server load balancing (SLB). During the real server and server farm configuration process, when you associate a real server with a server farm, ensure that you assign an appropriate port number for the real server. The default behavior by the ACE is to automatically assign the same destination port that was used by the inbound connection to the outbound server connection if you do not specify a port.
For example, if the incoming connection to the ACE is a secure client HTTPS connection, the connection is typically made on port 443. If you do not assign a port number to the real server, the ACE will automatically use port 443 to connect to the server, which results in the ACE making a clear-text HTTP connection over port 443. In this case, you would typically define an outbound destination port of 80, 81, or 8080 for the back-end server connection.
During the SLB traffic policy configuration process, you create the following configuration objects:
•
•
•
•
After configuring SLB, you modify the existing SLB class maps and policy maps with the SSL configuration requirements described in this guide for SSL termination.
To configure your ACE for SLB, see the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
SSL Termination Configuration Quick Start
Table 3-1 provides a quick overview of the steps required to configure the ACE for SSL termination. Each step includes the CLI command or a reference to the procedure required to complete the task. For a complete description of each feature and all the options associated with the CLI commands, see the sections following Table 3-1.
Note
Creating and Defining an SSL Parameter Map
An SSL parameter map defines the SSL session parameters that the ACE applies to an SSL proxy service. Creating an SSL parameter map allows you to apply the same SSL session parameters to different proxy services. Table 3-2 describes each SSL session parameter with its default value.
Table 3-2 SSL Session Parameters of an SSL Parameter Map
Cipher suites
Defines the cipher suites that the ACE supports during the SSL handshake (see Table 3-3 for a list of available cipher suites that the ACE supports)
The ACE supports all of the available cipher suites
Authentication-failure
When client authentication is enabled on the ACE, this parameter allows the ACE to continue setting up the front-end connection in an SSL termination configuration when it encounters a client certificate failure.
Disabled
CDP-errors ignore
When the crl best-effort command is configured on the ACE, this parameter allows the ACE to ignore authentication failures due to CDP errors.
Disabled
Close-protocol
Defines how the ACE executes close-notify messages
none—The ACE sends a close-notify alert message to its peer when closing a session but has no expectation of receiving one back from the peer
Version
Defines the SSL and TLS versions that the ACE supports during the SSL handshake
The ACE supports versions SSL3 and TLS1
Queue delay time
Defines the amount of time that the ACE keeps packet data from the server before encrypting it for the client
Disabled
Session cache timeout
Defines the amount of time that the SSL session ID remains valid before the ACE requires a new SSL handshake to establish a new SSL session.
Disabled
Expired CRL
Defines whether the ACE rejects all incoming client certificates if the CRL is expired.
Disabled
Note
You can create an SSL parameter map by using the parameter-map type ssl command in configuration mode.
The syntax of this command is as follows:
parameter-map type ssl parammap_name
The parammap_name argument is the name of the SSL parameter map. Enter an unquoted alphanumeric string with a maximum of 64 characters.
For example, to create the SSL parameter map PARAMMAP_SSL, enter:
host1/Admin(config)# parameter-map type ssl PARAMMAP_SSLAfter you create an SSL proxy parameter map, the CLI enters parameter map SSL configuration mode.
host1/Admin(config-parammap-ssl)#If you exit out of parameter map SSL configuration mode without defining any of its SSL session parameters, the ACE configures the parameter map with the default values listed in Table 3-2.
To delete an existing SSL parameter map, enter:
host1/Admin(config)# no parameter-map type ssl PARAMMAP_SSLThis section contains the following topics:
•
•
•
•
•
•
•
Adding a Cipher Suite
The SSL protocol supports a variety of different cryptographic algorithms, or ciphers, for use in operations such as the following:
•
•
•
Clients and servers may support different cipher suites, or sets of ciphers, depending on various factors, such as the version of SSL that they support, company policies regarding acceptable encryption strength, and government restrictions on export of SSL-enabled software. Among its other functions, the SSL handshake protocol determines how the server and client negotiate which cipher suite they will use to authenticate each other, transmit certificates, and establish session keys.
As shown in Figure 3-3, a cipher suite consists of the following three algorithms: key exchange algorithm, data encryption algorithm, and message authentication (hash) algorithm.
Figure 3-3 Cipher Suite Algorithms
Note
To define each of the cipher suites that you want the ACE to support during a secure session, use the cipher command in ssl parameter-map configuration mode. The cipher suite that you choose depends on your environment and security requirements and must correlate to the certificates and keys that you have loaded on the ACE.
Note
The syntax of this command is as follows:
cipher cipher_name [priority cipher_priority]
The keywords and arguments are as follows:
•
•
•
For example, to add the cipher suite rsa_with _aes_128_cbc_sha with a priority 2 level, enter:
host1/Admin(config)# parameter-map type ssl PARAMMAP_SSLhost1/Admin(config-parammap-ssl)# cipher rsa_with_aes_128_cbc_sha priority 2Repeat the cipher command for each cipher suite that you want to include in the SSL parameter map.
To delete a cipher suite from the SSL parameter map, enter:
host1/Admin(config-parammap-ssl)# no cipher rsa_with_aes_128_cbc_shaTable 3-3 lists the available cipher suites that the ACE supports and indicates which of the supported cipher suites are exportable from the ACE. The table also lists the authentication certificate and encryption key required by each cipher suite.
If you use the default setting in which the ACE implicitly supports all of the cipher suites listed in Table 3-3 or you explicitly define each cipher suite with equal priority and the client connection uses multiple ciphers, the ACE sends the cipher suites to its peer in the same order as they appear in the table, starting with RSA_WITH_RC4_128_MD5.
Caution
Continuing SSL Session Setup with Client Certificate Failures
By default, with client authentication enabled, when the ACE encounters one of the following client certificate failures during the setup of the front-end connection in an SSL termination configuration, it terminates the SSL handshake:
•
•
•
•
•
•
•
•
•
You can configure the ACE to either ignore these errors and continue the SSL handshake or perform an HTTP redirect after the handshake is complete by using the authentication-failure command in parameter map SSL configuration mode.
The syntax of this command is as follows:
authentication-failure {ignore | redirect reason {serverfarm serverfarm_name | url URL_string {301|302}}}
The keywords, arguments, and options are as follows:
•
You cannot configure the authentication-failure redirect any command with the authentication-failure ignore command.
•
For more than one failure reason, you configure an authentication-failure redirect command for each reason.
If multiple failures cause a redirect, the ACE performs a redirect on the first failure that it encounters. If that failure is corrected, the ACE performs a redirect on the next failure that it encounters.
For the reason argument, enter one of the following keywords:
–
–
–
–
–
–
–
–
–
–
•
•
•
–
–
For example, to ignore client certificate failures, enter:
host1/Admin(config)# parameter-map type ssl SSL_PARAMMAP_SSLhost1/Admin(config-parammap-ssl)# authentication-failure ignoreTo perform a redirect to a server farm when any client certificate failure occurs, enter:
host1/Admin(config-parammap-ssl)# authentication-failure redirect any serverfarm SFARM2To perform a redirect to a static URL with a 302 status code when an unknown-issuer failure occurs, enter:
host1/Admin(config-parammap-ssl)# authentication-failure redirect unknown-issuer url http://www.eng.com 302To reset the default behavior of terminating an SSL handshake when a client certificate failure occurs, use the no form of the command:
host1/Admin(config-parammap-ssl)# no authentication-failure redirect unknown-issuerThe following configuration example instructs the ACE to perform an HTTP redirect to either a server farm or directly to a URL depending on the type of client certificate failure:
crypto authgroup AUTH-GROUP1access-list EVERYONE line 8 extended permit ip any anyrserver redirect EXPIREDwebhost-redirection https://%h/support/expiredclientcert.html 302inservicerserver redirect INVALIDwebhost-redirection https://%h/support/invalidclientcert.html 302inservicerserver host SERVER1ip address 192.168.1.10inservicerserver host SERVER2ip address 192.168.1.20inserviceserverfarm redirect EXPIRED-CERTrserver EXPIREDinserviceserverfarm redirect INVALID-CERTrserver INVALIDinserviceserverfarm host WEBrserver SERVER1 80inservicerserver SERVER2 80inserviceparameter-map type ssl SSLPARAMauthentication-failure redirect cert-not-yet-valid serverfarm INVALID-CERTauthentication-failure redirect cert-expired serverfarm EXPIRED-CERTauthentication-failure redirect unknown-issuer url https://www.example.com/NewCertRequest.html 302ssl-proxy service SSLTERM-CLIENTAUTHssl advanced-options SSLPARAMclass-map match-all CMAP-HTTPS2 match virtual-address 172.16.1.100 tcp eq httpspolicy-map type management first-match MGMTPOLICYclass class-defaultpermitpolicy-map type loadbalance first-match SLBclass class-defaultserverfarm WEBpolicy-map multi-match VIPSclass CMAP-HTTPSloadbalance vip inserviceloadbalance policy SLBloadbalance vip icmp-replyinterface vlan 20ip address 172.16.1.1 255.255.255.0access-group input EVERYONEservice-policy input VIPSno shutdowninterface vlan 40ip address 192.168.1.1 255.255.255.0service-policy input MGMTPOLICYno shutdownConfiguring the ACE to Ignore Authentication Failures Due to CDP Errors
By default, when you configure the crl best-effort command for client certificate revocation, if the ACE detects CRL distribution point (CDP) errors in the presented certificates or errors that occur during a CRL download, the ACE rejects the SSL connection.
The cdp-errors ignore command allows you to configure an SSL parameter map to ignore CDP or download errors when the crl best-effort command is configured. When you configure the cdp-errors ignore command, the ACE allows SSL connections if it detects CDP errors in the presented certificates or it could not download a valid certificate revocation list (CRL) from valid CDPs on the certificates. The syntax for this command in parameter map SSL configuration mode is as follows:
cdp-errors ignore
For example, to configure the ACE to ignore CDP errors, enter:
host1/Admin(config)# parameter-map type ssl PARAMMAP_SSLhost1/Admin(config-parammap-ssl)# cdp-errors ignoreTo reset the default behavior where the ACE rejects an SSL connection when CDP errors occur, use the no form of the cdp-errors ignore command. For example, enter:
host1/Admin(config-parammap-ssl)# no cdp-errors ignoreTo display the number of times that the ACE ignored CDP errors in the presented SSL certificate and allowed the SSL connection, use the show crypto cdp-errors command. This command displays the output of the Best Effort CDP Errors Ignored field.
Defining the Close-Protocol Behavior
You can configure how the ACE handles the sending of close-notify messages by using the close-protocol command in the parameter map SSL configuration mode.
The syntax of this command is as follows:
close-protocol {disabled | none}
The keywords are as follows:
•
•
For example, to set close-protocol to disabled, enter:
host1/Admin(config)# parameter-map type ssl SSL_PARAMMAP_SSLhost1/Admin(config-parammap-ssl)# close-protocol disabledTo configure the close-protocol command with the default setting of none, use the no form of the command:
host1/Admin(config-parammap-ssl)# no close-protocolDefining the SSL and TLS Versions
You can specify the version of the security protocol that the ACE supports during the SSL handshake with its peer by using the version command in parameter map SSL configuration mode.
The syntax of this command is as follows:
version {all | ssl3 | tls1}
The keywords are as follows:
•
•
•
For example, to specify SSL Version 3.0 for the parameter map, enter:
host1/Admin(config)# parameter-map type ssl PARAMMAP_SSLhost1/Admin(config-parammap-ssl)# version ssl3To remove a security protocol version from the SSL proxy parameter map, enter:
host1/Admin(config-parammap-ssl)# no version tlslConfiguring the SSL Queue Delay
The ACE queues packet data from the server before encrypting it for transmission to the client. The ACE empties the data from the queue for encryption when one of the following events occurs:
•
•
•
The queue delay time is the amount of time that the ACE waits before emptying the queued data for encryption. By default, the queue delay timer is disabled. You can set the delay time by using the queue-delay timeout command in parameter map SSL configuration mode. The syntax of this command is as follows:
queue-delay timeout milliseconds
The milliseconds argument is the time in milliseconds before the data is emptied from the queue. Enter an integer from 0 to 10000. A value of 0 disables the delay timer, causing the ACE to encrypt data from the server as it arrives and then send the encrypted data to the client.
Note
For example, to set the queue delay time to 500 milliseconds, enter:
host1/Admin(config-parammap-ssl)# queue-delay timeout 500To disable the queue delay timer, enter:
host1/Admin(config-parammap-ssl)# no queue-delay timeoutConfiguring the SSL Session Cache Timeout
An SSL session ID is created every time that the client and the ACE perform a full SSL key exchange and establish a new master secret key. To quicken the SSL negotiation process between the client and the ACE, the SSL session ID reuse feature allows the ACE to reuse the secret key information in the session cache. On subsequent connections with the client, the ACE reuses the key stored in the cache from the last negotiated session. The ACE can store a maximum of 200,000 SSL session IDs in the session cache.
By default, SSL session ID reuse is disabled on the ACE. You can enable session ID reuse by setting a session cache timeout value for the total amount of time that the SSL session ID remains valid before the ACE requires a full SSL handshake to establish a new session.
You can set the session cache timeout by using the session-cache timeout command in parameter map SSL configuration mode. The syntax of this command is as follows:
session-cache timeout seconds
The seconds argument is the time in seconds that the ACE reuses the key stored in the cache before removing the session IDs. Enter an integer from 0 to 72000 (20 hours). By default, session ID reuse is disabled. A value of 0 causes the ACE to remove the session IDs from the cache when the cache is full and to implement the least-recently used (LRU) timeout policy.
For example, to set the session cache timeout to 600 seconds, enter:
host1/Admin(config-parammap-ssl)# session-cache timeout 600To disable the timer and allow the SSL full handshake to occur for each new connection with the ACE, enter:
host1/Admin(config-parammap-ssl)# no session-cache timeoutTo clear the session cache information for the context, use the clear crypto session-cache command. The syntax of this command is as follows:
clear crypto session-cache [all]
The all optional keyword clears all session cache information for all contexts. This option is available in the Admin context only.
Rejecting Expired CRL Client Certificates
When you configure Certificate Revocation Lists (CRLs) on the ACE for client authentication, as described in the "Using CRLs During Client Authentication" section, the CRLs contain an update field that specifies the date when a new version would be available. By default, the ACE does not use CRLs that contain an update field with an expired date and, thus, does not reject incoming client certificates using the CRL.
To configure the ACE to reject a client certificate when the CRL in use has expired, use the expired-crl reject command in parameter map SSL configuration mode. The syntax of this command is as follows:
expired-crl reject
For example, enter:
host1/Admin(config-parammap-ssl)# expired-crl rejectTo reset the default behavior of the ACE accepting a client certificate after the CRL in use has expired, enter:
host1/Admin(config-parammap-ssl)# no expired-crl rejectCreating and Defining an SSL Proxy Service
The SSL proxy service defines the SSL parameter map, key pair, certificate, and chain group that the ACE uses during the SSL handshake. For SSL termination, you configure the ACE with an SSL proxy server service because the ACE acts as an SSL server.
You can create an SSL proxy server service by using the ssl-proxy service command in configuration mode.
The syntax of this command is as follows:
ssl-proxy service pservice_name
The pservice_name argument is the name of the SSL proxy server service. Enter an unquoted alphanumeric string with a maximum of 64 characters.
For example, to create the SSL proxy server service PSERVICE_SERVER, enter:
host1/Admin(config)# ssl-proxy service PSERVICE_SERVERAfter you create an SSL proxy server service, the CLI enters SSL proxy configuration mode.
host1/Admin(config-ssl-proxy)#To delete an existing SSL proxy server service, enter:
host1/Admin(config)# no ssl-proxy PSERVICE_SERVERThis section contains the following topics:
•
•
•
•
•
•
Associating an SSL Parameter Map with the SSL Proxy Server Service
You can associate an SSL parameter map with the SSL proxy server service by using the ssl advanced-options command in SSL proxy configuration mode.
The syntax of this command is as follows:
ssl advanced-options parammap_name
The parammap_name argument is the name of an existing SSL parameter map (see the "Creating and Defining an SSL Parameter Map" section). Enter an unquoted alphanumeric string with a maximum of 64 characters.
For example, to associate the parameter map PARAMMAP_SSL with the SSL proxy service, enter:
host1/Admin(config)# ssl-proxy service PSERVICE_SERVERhost1/Admin(config-ssl-proxy)# ssl advanced-options PARAMMAP_SSLTo remove the association of an SSL parameter map with the SSL proxy service, enter:
host1/Admin(config-ssl-proxy)# no ssl advanced-options PARAMMAP_SSLSpecifying the Key Pair
You can specify the key pair that the ACE uses during the SSL handshake for data encryption by using the key command in SSL proxy configuration mode.
Note
The syntax of this command is as follows:
key {key_filename | cisco-sample-key}
The argument and keyword are as follows:
•
•
For example, to specify the private key in the key pair file MYKEY.PEM, enter:
host1/Admin(config)# ssl-proxy service PSERVICE_SERVERhost1/Admin(config-ssl-proxy)# key MYKEY.PEMTo delete a private key from the SSL proxy service, enter:
host1/Admin(config-ssl-proxy)# no key MYKEY.PEMSpecifying the Certificate
You can specify the certificate that the ACE uses during the SSL handshake process to prove its identity by using the cert command in SSL proxy configuration mode.
Note
The syntax of this command is as follows:
cert {cert_filename | cisco-sample-cert}
The argument and keyword are as follows:
•
•
For example, to specify the certificate in the certificate file MYCERT.PEM, enter:
host1/Admin(config)# ssl-proxy service PSERVICE_SERVERhost1/Admin(config-ssl-proxy)# cert MYCERT.PEMTo delete a certificate file from the SSL proxy service, enter:
host1/Admin(config-ssl-proxy)# no cert MYCERT.PEMSpecifying the Certificate Chain Group
You can specify the certificate chain that the ACE sends to its peer during the SSL handshake by using the chaingroup command in SSL proxy configuration mode. The ACE includes the certificate chain with the certificate that you specified for the SSL proxy service (see the "Specifying the Certificate" section).
The syntax of this command is as follows:
chaingroup group_name
The group_name argument is the name of an existing certificate chain group (see the "Creating a Chain Group" section in Chapter 2, Managing Certificates and Keys). The maximum size of a chain group is 16 KB. Enter an unquoted alphanumeric string with a maximum of 64 characters.
Note
For example, to specify the certificate chain group MYCHAINGROUP, enter:
host1/Admin(config)# ssl-proxy service PSERVICE_SERVERhost1/Admin(config-ssl-proxy)# chaingroup MYCHAINGROUPTo delete a certificate chain group from the SSL proxy service, enter:
host1/Admin(config-ssl-proxy)# no chaingroup MYCHAINGROUPEnabling Client Authentication
During the flow of a normal SSL handshake, the server sends its certificate to the client. The client verifies the identity of the server through the certificate. However, the client does not send any identification of its own to the server. When you enable the client authentication feature on the ACE, the ACE requires that the client sends a certificate to the server. The server then verifies the following information on the certificate:
•
•
•
•
You can specify the certificate authentication group that the ACE uses during the SSL handshake and enable client authentication on this SSL proxy service by using the authgroup command in SSL proxy configuration mode. The ACE includes the certificates configured in the group with the certificate that you specified for the SSL proxy service (see the "Specifying the Certificate" section).
The syntax of this command is as follows:
authgroup group_name
The group_name argument is the name of an existing certificate authentication group (see the "Configuring a Group of Certificates for Authentication" section in Chapter 2, Managing Certificates and Keys). Enter an unquoted alphanumeric string with a maximum of 64 characters.
Note
Note
For example, to specify the certificate authentication group AUTH-CERT1, enter:
host1/Admin(config-ssl-proxy)# authgroup AUTH-CERT1To delete a certificate authentication group from the SSL proxy service, enter:
host1/Admin(config-ssl-proxy)# no authgroup AUTH-CERT1Using CRLs During Client Authentication
By default, the ACE does not use certificate revocation lists (CRLs) during client authentication. The ACE supports CRL downloads through HTTP or LDAP. You can configure the SSL proxy service to use a CRL in one of the following ways:
•
•
Note
When attempting to download a CRL:
•
•
•
•
•
For detailed CRL download statistics, see the "Displaying CRL Information" section in Chapter 6, "Displaying SSL Information and Statistics."
You can determine which CRL information to use for client authentication by using the crl command in SSL proxy configuration mode. The syntax of this command is as follows:
crl {crl_name | best-effort}
The argument and keyword are as follows:
•
•
For example, to enable the CRL1 CRL for client authentication on an SSL proxy service, enter:
host1/Admin(config-ssl-proxy)# crl CRL1To scan the client certificate for CRL information, enter:
host1/Admin(config-ssl-proxy)# crl best-effortTo disable the use of a downloaded CRL during client authentication, enter:
host1/Admin(config-ssl-proxy)# no crl CRL1To disable the use of client certificates for CRL information during client authentication, enter:
host1/Admin(config-ssl-proxy)# no crl best-effortConfiguring the Download Location for CRLs
You can configure the location that the ACE uses to download the CRL to the SSL proxy service for client authentication. If the service is not configured on a policy map or the policy map is not active, the ACE does not download the CRL. The ACE downloads the CRL under the following conditions:
•
•
•
You can configure a maximum of eight CRLs per context. After you configure the CRL, assign it to an SSL proxy service for client authentication (see the "Using CRLs During Client Authentication" section).
The ACE translates the hostnames within the CRLs to IP addresses using a Domain Name System (DNS) client that you configure. For details about configuring a DNS client, see the "Configuring a DNS Client" section.
To configure a downloaded CRL, use the crypto crl command in configuration mode. The syntax of this command is as follows:
crypto crl crl_name url
The arguments are as follows:
•
•
The ldap:/// prefix is not considered a valid LDAP CRL link in the CDP portion of the server certificate. Valid formats for LDAP URLs are as follows:
–
–
–
–
To use a question mark (?) character as part of the URL, press Ctrl-v before entering it. Otherwise the ACE interprets the question mark as a help command.
Note
For example, to configure a CRL that you want to name CRL1 from http://crl.verisign.com/class1.crl, enter:
host1/Admin(config)# crypto crl CRL1 http://crl.verisign.com/class1.crlTo remove the CRL, enter:
host1/Admin(config)# no crypto crl CRL1For example, Figure 3-4 illustrates a sample configuration for CRL downloading through LDAP in client authentication.
Figure 3-4 CRL Download through the LDAP Protocol
The following example is the configuration of the authentication group with the root certificate that signed the client certificate:
crypto authgroup root_ca_poolcert root-cert-2.cerThe following example provides the configuration for the ldap:// based CDP URL:
crypto crl win2003crl1 ldap://windows2003-srv.win2003.cisco.com/CN=root-ca(2),CN=windows2003- srv,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC= win2003,DC=cisco,DC=com?certificateRevocationList?base?objectClass=cRL DistributionPointaccess-list capture-acl line 8 extended permit tcp any any access-list permit-http line 8 extended permit tcp any any eq httpsThe following example provides the DNS configuration for the ACE module to successfully resolve the hostname in the ldap:// URL during the CRL download:
ip domain-lookupip domain-name win2003.cisco.comip name-server 10.1.1.147rserver host SERVER1ip address 10.1.1.122inservicessl-proxy service SSL_PSERVICE_SERVERkey MYKEY.PEMcert MYSCERT.PEMauthgroup root_ca_poolcrl win2003crl1serverfarm host SFARM1rserver SERVER1 80inserviceclass-map match-any L4_SSL-TERM_CLASS3 match virtual-address 192.168.1.100 tcp eq httpsclass-map type http loadbalance match-all URLCLASS12 match http url .*policy-map type loadbalance first-match L7_SSL-TERM_POLICYclass URLCLASS1serverfarm SFARM1policy-map multi-match L4_SSL-VIP_POLICYclass L4_SSL-TERM_CLASSloadbalance vip inserviceloadbalance policy L7_SSL-TERM_POLICYloadbalance vip icmp-replyssl-proxy server SSL_PSERVICE_SERVERinterface vlan 50ip address 10.1.1.138 255.255.0.0no shutdowninterface vlan 200ip address 192.168.1.254 255.255.0.0access-group input permit-httpservice-policy input L4_SSL-VIP_POLICYno shutdownConfiguring Signature Verification on a CRL
You can configure signature verification on a Certificate Revocation List (CRL) to determine that it is from a trusted certificate authority by using the crypto crlparams command in Exec command mode. The syntax of this command is as follows:
crypto crlparams crl_name cacert ca_cert_filename
The arguments are as follows:
•
•
For example, to configure signature verification on a CRL, enter:
host1/Admin(config)# crypto crlparams CRL1 cacert MYCERT.PEM
To remove signature verification from a CRL, enter:
host1/Admin(config)# no crypto crlparams CRL1
Configuring a DNS Client
With the client authentication feature, you can configure a Domain Name System (DNS) client on the ACE to communicate with a DNS server to provide hostname-to-IP-address translation for hostnames in CRLs. For details about client authentication, see the "Using CRLs During Client Authentication" section.
Before you configure a DNS client on the ACE, ensure that one or more DNS name servers are properly configured and reachable. Otherwise, translation requests (domain lookups) from the DNS client will be discarded. You can configure a maximum of three name servers. The ACE attempts to resolve the hostnames with the configured name servers in order until the translation succeeds. If the translation fails, the ACE reports an error.
For unqualified hostnames (hostnames that do not contain a domain name), you can configure a default domain name or a list of domain names that the ACE can use to perform the following tasks:
•
•
To display the DNS client configuration, use the show running-config command.
This section contains the following topics:
•
•
•
Enabling Domain Lookups
To enable the ACE to perform a domain lookup (host-to-address translation) with a DNS server, use the ip domain-lookup command in configuration mode. By default, this command is disabled. The syntax of this command is as follows:
ip domain-lookup
For example, to enable domain lookups, enter:
host1/Admin(config)# ip domain-lookupTo return the state of domain lookups to the default value of disabled, enter:
host1/Admin(config)# no ip domain-lookupConfiguring a Default Domain Name
The DNS client feature allows you to configure a default domain name that the ACE uses to complete unqualified hostnames. An unqualified hostname is one that does not contain a domain name (any name without a dot). When domain lookups are enabled and a default domain name is configured, the ACE appends a dot (.) and the configured default domain name to the unqualified hostname and attempts a domain lookup.
To configure a default domain name, use the ip domain-name command in configuration mode. The syntax of this command is as follows:
ip domain-name name
The name argument is an unquoted text string with no spaces and a maximum of 85 alphanumeric characters.
For example, to specify a default domain name of cisco.com, enter:
host1/Admin(config)# ip domain-name cisco.comIn the above example, the ACE appends .cisco.com to any unqualified hostname in a CRL before the ACE attempts to resolve the hostname to an IP address using a DNS name server.
To remove the default domain from the configuration, enter:
host1/Admin(config)# no ip domain-name cisco.comConfiguring a Domain Name Search List
Instead of configuring a single default domain name, you can configure a domain name search list that the ACE uses to complete unqualified hostnames. The domain name list can contain a maximum of three domain names. If you configure both a domain name list and a default domain name, the ACE uses only the domain name list and not the single default name. After you have enabled domain name lookups and configured a domain name list, the ACE uses each domain name in turn until it can resolve a single domain name into an IP address.
To configure a domain name search list, use the ip domain-list command. The syntax of this command is as follows:
ip domain-list name
The name argument is an unquoted text string with no spaces and a maximum of 85 alphanumeric characters.
For example, to configure a domain name list, enter:
host1/Admin(config)# ip domain-list cisco.comhost1/Admin(config)# ip domain-list foo.comhost1/Admin(config)# ip domain-list xyz.comTo remove a domain name from the list, enter:
host1/Admin(config)# no ip domain-list xyz.comConfiguring a Domain Name Server
To translate a hostname to an IP address, you must configure one or more (maximum of three) existing DNS name servers on the ACE. Ping the IP address of each name server before you configure it to ensure that the server is reachable.
To configure a name server, use the ip name-server command in configuration mode. The syntax of this command is as follows:
ip name-server ip_address
The ip_address argument is the IP address of a name server in dotted decimal notation (for example, 192.168.12.15). You can enter up to three name server IP addresses in one command line.
For example, to configure three name servers for the DNS client feature, enter:
host1/Admin(config)# ip name-server 192.168.12.15 192.168.12.16 192.168.12.17To remove a name server from the list, enter:
host1/Admin(config)# no ip name-server 192.168.12.15Configuring SSL URL Rewrite and HTTP Header Insertion
When a client sends encrypted traffic to the ACE in an SSL termination configuration, the ACE terminates the SSL traffic and then sends clear text to the server, which is unaware of the encrypted traffic flowing between the client and the ACE. Using an action list associated with a Layer 7 HTTP load-balancing policy map, you can instruct the ACE to perform the following tasks:
•
•
–
–
–
The following sections describe how to configure the ACE for SSL URL rewrite and HTTP header insertion using an action list that provides the ACE with the necessary instructions.
This section contains the following topics:
•
•
•
•
•
Configuring the Action List
To configure SSL URL rewrite or HTTP header insertion, you must first create a new action list or use an existing action list of type modify.
Caution
An action list is a named group of related actions that you want the ACE to perform. For example, to create an action list, enter the following command in configuration mode:
host1/Admin(config)# action-list type modify http SSL_ACTLISThost1/Admin(config-actlist-modify)#The action-list type modify http command enters the action list modify configuration mode from which you define the parameters for the following features:
•
•
•
•
For more information about action lists, see the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
Configuring SSL URL Rewrite
Because the server is unaware of the encrypted traffic flowing between the client and the ACE, the server may return to the client a URL in the Location header of HTTP redirect responses (301: Moved Permanently or 302: Found) in the form http://www.cisco.com instead of https://www.cisco.com. In this case, the client makes a request to the unencrypted insecure URL, even though the original request was for a secure URL. Because the client connection changes to HTTP, the requested data may not be available from the server using a clear text connection.
To solve this problem, the ACE provides SSLURL rewrite, which changes the redirect URL from http:// to https:// in the Location response header from the server before sending the response to the client. By using URL rewrite, you can avoid nonsecure HTTP redirects. All client connections to the web server will be SSL, ensuring the secure delivery of HTTPS content back to the client. The ACE uses regular expression matching to determine whether the URL needs rewriting. If a Location response header matches the specified regular expression, the ACE rewrites the URL. In addition, the ACE provides commands to add or change the SSL and the clear port numbers.
You can define the SSL URL, SSL port, and clear port for rewrite by using the ssl url rewrite command in action list modify configuration mode. The syntax of this command is as follows:
ssl url rewrite location expression [sslport number1] [clearport number2]
The arguments, keywords, and options are as follows:
•
The location regex that you enter must be a pure URL (for example, www\.cisco\.com) with no port or path designations. To match a port, use the sslport and clearport keywords as described later in this section. If you need to match a path, use the HTTP header rewrite feature to rewrite the string. For information about the HTTP header rewrite feature, see the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
The ACE supports the use of regular expressions for matching data strings. See Table 3-4 for a list of the supported characters that you can use in regular expressions.
Note
•
•
For example, to specify SSL URL rewrite for the URL www.cisco.com or www.cisco.net using the default SSL port of 443 and a clear port of 8080, enter:
host1/Admin(config-actlist-modify)# ssl url rewrite location www\.cisco\..* sslport 443 clearport 8080In the above example, the ACE attempts to perform the following tasks:
•
•
•
After you enter the ssl url rewrite command, associate the action list with a Layer 3 and Layer 4 policy map. See the "Associating an Action List with a Layer 7 HTTP Load-balancing Policy Map" section.
Configuring HTTP Header Insertion of SSL Session Parameters
You can instruct the ACE to provide the server with SSL session parameter information that the ACE and the client negotiate during the SSL handshake, such as the cipher suite to use for encrypting the information or the SSL session ID. To forward this SSL session information to the server, the ACE inserts HTTP headers containing the negotiated session parameter fields that you specify into the HTTP requests that it receives over the client connection. The ACE then forwards the HTTP request to the server.
Note
When you instruct the ACE to insert SSL session information, by default, the ACE inserts the HTTP header information into only the first HTTP request that it receives over the client connection. When the ACE and client need to renegotiate their connection, the ACE updates the HTTP header information that it sends to the server to reflect the new session parameters. You can also instruct the ACE to insert the session information into every HTTP request that it receives over the connection by creating an HTTP parameter map with either the header modify per-request or persistence-rebalance command enabled. You then reference the parameter map in the policy map that the ACE applies to the traffic. For information about creating an HTTP parameter map, see the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
Note
You can insert an HTTP header that contains specific SSL session information by using the ssl header-insert session command in action list modify configuration mode. To remove an HTTP header that contains an SSL session information field, use the no form of the command.
The syntax of this command is as follows:
ssl header-insert session specific_field [prefix prefix_string | rename new_field_name]
The keywords and arguments are as follows:
•
•
•
Note
Table 3-5 lists the supported SSL session fields.
For example, to insert the name of the cipher suite being used for the SSL session into the HTTP header, enter:
host1/Admin(config-actlist-modify)# ssl header-insert session Cipher-NameRepeat the ssl header-insert session command for each session parameter field that you want the server to receive.
For information about the counters that track the success rate of inserting the SSL HTTP header information, see Chapter 6, "Displaying SSL Information and Statistics."
Configuring HTTP Header Insertion of SSL Server Certificate Information
You can instruct the ACE to provide the server with information about the server certificate that resides on the ACE, such as the algorithm used for the public key or the certificate serial number. To forward this SSL session information to the server, the ACE inserts HTTP headers containing the server certificate fields that you specify into the HTTP requests that it receives over the client connection. The ACE then forwards the HTTP requests to the server.
Note
When you instruct the ACE to insert SSL server certificate information, by default, the ACE inserts the HTTP header information into only the first HTTP request that it receives over the client connection. You can also instruct the ACE to insert the information into every HTTP request that it receives over the connection by creating an HTTP parameter map with either the header modify per-request or persistence-rebalance command enabled. You then reference the parameter map in the policy map that the ACE applies to the traffic. For information about creating an HTTP parameter map, see the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
Note
You can insert an HTTP header that contains specific SSL server certificate information fields by using the ssl header-insert server-cert command in action list modify configuration mode. To remove an SSL HTTP header that contains a server certificate information field, use the no form of the command.
The syntax of this command is as follows:
ssl header-insert server-cert specific_field [prefix prefix_string | rename new_field_name]
The keywords and arguments are as follows:
•
•
•
Note
Table 3-6 lists the supported SSL server certificate fields. Depending on how the certificate was generated and what key algorithm was used, all of these fields may not be present for the certificate.
For example, to insert the server certificate distinguished name into the HTTP header, enter:
host1/Admin(config-actlist-modify)# ssl header-insert server-cert SubjectRepeat the ssl header-insert server-cert command for each server certificate field that you want the server to receive.
For information about the counters that track the success rate of inserting the SSL HTTP header information, see Chapter 6, "Displaying SSL Information and Statistics."
Configuring HTTP Header Insertion of SSL Client Certificate Information
When you configure the ACE for client authentication, you can instruct the ACE to provide the server with information about the client certificate that the ACE receives from the client. This SSL session information enables the server to properly manage the client request and can include certificate information such as the certificate serial number or the public key algorithm used to create the public key in the certificate. To forward the SSL session information to the server, the ACE inserts HTTP headers containing the client certificate fields that you specify into the HTTP requests that it receives over the client connection. The ACE then forwards the HTTP requests to the server.
Note
When you instruct the ACE to insert SSL client certificate information, by default, the ACE inserts the HTTP header information into only the first HTTP request that it receives over the client connection. You can also instruct the ACE to insert the information into every HTTP request that it receives over the connection by creating an HTTP parameter map with either the header modify per-request or persistence-rebalance command enabled. You then reference the parameter map in the policy map that the ACE applies to the traffic. For information about creating an HTTP parameter map, see the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
Note
Note
You can insert an HTTP header that contains specific SSL client certificate fields by using the ssl header-insert client-cert command in action list modify configuration mode. To remove client certificate information from the HTTP header, use the no form of the command.
The syntax of this command is as follows:
ssl header-insert client-cert specific_field [prefix prefix_string | rename new_field_name]
The keywords and arguments are as follows:
•
•
•
Note
Table 3-7 lists the supported SSL client certificate fields. Depending on how the certificate was generated and what key algorithm was used, all of these fields may not be present for the certificate.
For example, to insert the client certificate distinguished name into the HTTP header, enter:
host1/Admin(config-actlist-modify)# ssl header-insert client-cert SubjectRepeat the ssl header-insert client-cert command for each client certificate field that you want the server to receive.
For information about the counters that track the success rate of inserting the SSL HTTP header information, see Chapter 6, "Displaying SSL Information and Statistics."
Associating an Action List with a Layer 7 HTTP Load-balancing Policy Map
You can associate an action list with a Layer 7 HTTP loadbalancing policy map by using the action command in policy map load balance class configuration mode. For more information about creating class maps and policy maps, see the "Creating a Layer 3 and Layer 4 Class Map for SSL Termination" and "Creating a Layer 3 and Layer 4 Policy Map for SSL Termination" sections.
Caution
The syntax of this command is as follows:
action name
The name argument is the identifier of an existing action list. Enter an unquoted text string with a maximum of 64 alphanumeric characters.
For example, to associate an action list for SSL URL rewrite with a Layer 7 HTTP load-balancing policy map, enter:
host1/Admin(config)# policy-map type loadbalance http first-match L7_POLICYhost1/Admin(config-pmap-lb)# class CLASS-DEFAULThost1/Admin(config-pmap-lb-c)# action SSL_ACTLISTTo disassociate the action list from the policy map, enter:
host1/Admin(config-pmap-lb-c)# no action SSL_ACTLISTExample Configurations Containing HTTP Header Insertion
This section contains the following example configurations:
•
•
Inserting SSL Session Information Into the First HTTP Request Only
This section contains a configuration example that includes an action list (ACTION-SSL-INS) for inserting SSL session information. The configuration uses the default method of inserting the information into only the first HTTP request that the ACE receives over the connection.
The configuration example is as follows:
serverfarm host SFARM-1rserver SERVER1inservicerserver SERVER2inservicecrypto authgroup A1cert CACERT3.PEMssl-proxy service SSL_PSERVICE_TERMINATIONkey RSAKEY.PEMcert RSACERT.PEMauthgroup A1class-map type http loadbalance match-all CM-12 match http url /index.htmlaction-list type modify http ACTION-SSL-INSssl header-insert session Id prefix SSL-ssl header-insert server-cert Issuerssl header-insert client-cert Serial-Number rename Client-Serial-Numberpolicy-map type loadbalance http first-match PM-HTTP-LBclass CM-1serverfarm SFARM-1class class-defaultaction ACTION-SSL-INSpolicy-map multi-match SP-HTTP-LB-POLICYclass VIP-MERCURYloadbalance vip inserviceloadbalance policy PM-HTTP-LBloadbalance vip icmp-replyinspect httpappl-parameter http advanced-options HTTP-PMAPssl-proxy server SSL_PSERVICE_TERMINATIONinterface vlan 2524ip address 192.168.1.1 255.255.255.0access-group input ALLservice-policy input SP-HTTP-LB-POLICYservice-policy input MGMT-POLICYno shutdownInserting SSL Session Information Into All HTTP Requests
This section contains a configuration example that includes an action list (ACTION-SSL-INS) for inserting SSL session information. The configuration includes an HTTP parameter map (HTTP-PMAP) that instructs the ACE to insert the session information into each HTTP request that it receives over the connection. For this example, the parameter map uses the persistence-rebalance command to enable HTTP header insertion into every HTTP request but you can use the header modify per-request command instead for this purpose. For information about creating an HTTP parameter map, see the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
The configuration example is as follows:
serverfarm host SFARM-1rserver SERVER1inservicerserver SERVER2inservicecrypto authgroup A1cert CACERT3.PEMssl-proxy service SSL_PSERVICE_TERMINATIONkey RSAKEY.PEMcert RSACERT.PEMauthgroup A1class-map type http loadbalance match-all CM-12 match http url /index.htmlparameter-map type http HTTP-PMAPpersistence-rebalanceaction-list type modify http ACTION-SSL-INSssl header-insert session Id prefix SSL-ssl header-insert server-cert Issuerssl header-insert client-cert Serial-Number rename Client-Serial-Numberpolicy-map type loadbalance http first-match PM-HTTP-LBclass CM-1serverfarm SFARM-1class class-defaultaction ACTION-SSL-INSpolicy-map multi-match SP-HTTP-LB-POLICYclass VIP-MERCURYloadbalance vip inserviceloadbalance policy PM-HTTP-LBloadbalance vip icmp-replyinspect httpappl-parameter http advanced-options HTTP-PMAPssl-proxy server SSL_PSERVICE_TERMINATIONinterface vlan 2524ip address 192.168.1.1 255.255.255.0access-group input ALLservice-policy input SP-HTTP-LB-POLICYservice-policy input MGMT-POLICYno shutdownCreating a Layer 3 and Layer 4 Class Map for SSL Termination
The class map that you associate with a policy map acts as a filter for traffic that matches the criteria that you specify. For SSL termination, you can define the match criteria based on one or more of the following traffic characteristics:
•
•
•
•
•
You can create a Layer 3 and Layer 4 class map by using the class-map command in configuration mode. For details on creating and configuring a Layer 3 and Layer 4 class map, see the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.
Creating a Layer 3 and Layer 4 Policy Map for SSL Termination
For SSL termination, you configure the ACE so that it is recognized as an SSL server by a client. To accomplish this, you configure a Layer 3 and Layer 4 policy map that the ACE applies to the inbound traffic. The policy map uses the Layer 3 and Layer 4 class map that you associate with it to determine whether the inbound traffic matches the criteria that you specify. When a match is found, the ACE engages the client in the SSL handshake and establishes an SSL session using the parameters that you specify in the associated SSL proxy server service.
This section contains the following topics:
•
•
•
Creating a Layer 3 and Layer 4 Policy Map
You can create an SSL termination policy map by using the policy-map command in configuration mode.
The syntax of this command is as follows:
policy-map multi-match policy_name
The policy_name argument is the name that you assign to the policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to create the policy map L4POLICY, enter:
host1/Admin(config)# policy-map multi-match L4POLICYAfter you create a policy map, the CLI enters into policy map configuration mode.
host1/Admin(config-pmap)#To delete an existing policy map, enter:
host1/Admin(config)# no policy-map L4POLICYFor information on associating an SSL class map with the policy map, see the "Associating the Layer 3 and Layer 4 Class Map with the Policy Map" section.
Associating the Layer 3 and Layer 4 Class Map with the Policy Map
You can associate the Layer 3 and Layer 4 class map with the policy map by using the class command in policy map configuration mode.
The syntax of this command is as follows:
class class-map
The class-map argument is the name of an existing class map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to associate the class map L4VIPCLASS with the policy map, enter:
host1/Admin(config)# policy-map multi-match L4POLICYhost1/Admin(config-pmap)# class L4VIPCLASSAfter you associate a class map with the policy map, the CLI enters into policy-map class-map configuration mode.
host1/Admin(config-pmap-c)#To remove the association of a class map to the policy map, enter:
host1/Admin(config-pmap)# no class L4VIPCLASSFor information on associating an SSL proxy service with the class map, see the "Associating an SSL Proxy Server Service with the Policy Map" section.
Associating an SSL Proxy Server Service with the Policy Map
You can associate an SSL proxy server service with the policy map by using the ssl-proxy server command in policy map class configuration mode.
The syntax of this command is as follows:
ssl-proxy server pservice
The pservice argument is the name of an existing SSL proxy server service. Enter an unquoted alphanumeric string with a maximum of 64 characters.
For example, to associate the SSL proxy server service PSERVICE_SERVER with the policy map, enter:
host1/Admin(config)# policy-map multi-match L4POLICYhost1/Admin(config-pmap)# class L4VIPCLASShost1/Admin(config-pmap-c)# ssl-proxy server PSERVICE_SERVERTo remove the class map association, enter:
host1/Admin(config-pmap-c)# no ssl-proxy server PSERVICE_SERVERApplying the Policy Map to the VLANs
This section describes how to apply the Layer 3 and Layer 4 policy map to the VLAN traffic. The ACE allows you to apply the policy globally to all VLANs within the current context or to a specific VLAN in the context.
This section contains the following topics:
•
•
Applying the Policy Map Globally
You can globally apply the policy map to all VLANs in the context by using the service-policy command in configuration mode.
The syntax of this command is as follows:
service-policy input policy_name
The policy_name argument is the name of an existing policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to globally apply the policy map L4POLICY to all VLANs in the context, enter:
host1/Admin(config)# service-policy input L4POLICYTo globally remove the policy from all VLANs, enter:
host1/Admin(config)# no service-policy input L4POLICYApplying the Policy Map to a Specific VLAN
To apply a policy map to a specific VLAN interface, you must enter interface configuration mode by using the interface command in configuration mode.
The syntax of this command is as follows:
interface vlan vlan
The vlan argument is the context VLAN number. Enter an integer from 2 to 4094.
For example, to enter interface configuration mode for VLAN 10, enter:
host1/Admin(config)# interface vlan 10host1/Admin(config-if)#You can apply the policy map to the interface by using the service-policy command in interface configuration mode.
The syntax of this command is as follows:
service-policy input policy-name
The policy-name argument is the name of an existing policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to apply the policy map L4POLICY to VLAN 10, enter:
host1/Admin(config)# interface vlan 10host1/Admin(config-if)# service-policy input L4POLICYTo remove the policy from the interface, enter:
host1/Admin(config-if)# no service-policy input L4POLICYExample of an SSL Termination Configuration
The following example illustrates a running configuration of the ACE acting as an SSL proxy server; terminating SSL or TLS connections from a client and then establishing a TCP connection to an HTTP server. When the ACE terminates the SSL or TLS connection, it decrypts the cipher text from the client and transmits the data as clear text to the HTTP server. The SSL termination configuration appears in bold in the example.
access-list ACL1 line 10 extended permit ip any anyprobe https GEN-HTTPSport 80interval 50faildetect 5expect status 200 200serverfarm host SFARM1description SERVER FARM 1 FOR SSL TERMINATIONprobe GEN-HTTPSrserver SERVER1 80inservicerserver SERVER2 80inservicerserver SERVER3 80inservicerserver SERVER4 80inserviceserverfarm host SFARM2description SERVER FARM 2 FOR SSL TERMINATIONprobe GEN-HTTPSrserver SERVER5 80inservicerserver SERVER6 80inservicerserver SERVER7 80inservicerserver SERVER8 80inserviceparameter-map type ssl PARAMMAP_SSL_TERMINATIONcipher RSA_WITH_3DES_EDE_CBC_SHAcipher RSA_WITH_AES_128_CBC_SHA priority 2cipher RSA_WITH_AES_256_CBC_SHA priority 3version allparameter-map type connection TCP_PARAMsyn-data dropexceed-mss allowssl-proxy service SSL_PSERVICE_SERVERssl advanced-options PARAMMAP_SSL_TERMINATIONkey MYKEY.PEMcert MYCERT.PEMclass-map type http loadbalance match-all L7_SERVER_CLASSdescription Sticky for SSL Testing2 match http url .*.jpg3 match source-address 192.168.130.0 255.255.255.0class-map type http loadbalance match-all L7_SLB-HTTP_CLASS2 match http url .*3 match source-address 192.168.130.0 255.255.255.0class-map match-all L4_SSL-TERM_CLASSdescription SSL Termination VIP2 match virtual-address 192.168.130.11 tcp eq httpspolicy-map type loadbalance first-match L7_SSL-TERM_POLICYclass L7_SERVER_CLASSserverfarm SFARM1insert-http I_AM header-value "SSL_TERM"insert-http SRC_Port header-value "%ps"insert-http DEST_IP header-value "%id"insert-http DEST_Port header-value "%pd"insert-http SRC_IP header-value "is"class L7_SLB-HTTP_CLASSserverfarm SFARM1insert-http I_AM header-value "SSL_TERM"insert-http SRC_Port header-value "%ps"insert-http DEST_IP header-value "%id"insert-http DEST_Port header-value "%pd"insert-http SRC_IP header-value "is"policy-map multi-match L4_SSL-VIP_POLICYclass L4_SSL-TERM_CLASSloadbalance vip inserviceloadbalance policy L7_SSL-TERM_POLICYloadbalance vip icmp-replyssl-proxy server SSL_PSERVICE_SERVERconnection advanced-options TCP_PARAMinterface vlan 120description Upstream VLAN_120 - Clients and VIPsip address 192.168.120.1 255.255.255.0fragment chain 20fragment min-mtu 68access-group input ACL1nat-pool 1 192.168.120.70 192.168.120.80 netmask 255.255.255.0 patservice-policy input L4_SSL-VIP_POLICYno shutdownip route 10.1.0.0 255.255.255.0 192.168.120.254
