Brocade Communications Systems ServerIron ADX 12.4.00a User manual

53-1002440-03

June 2012

ServerIron ADX

Security Guide

Supporting Brocade ServerIron ADX version 12.4.00a

Brocade, Brocade Assurance, the B-wing symbol, DCX, Fabric OS, MLX, SAN Health, VCS, and VDX are registered trademarks, and

AnyIO, Brocade One, CloudPlex, Effortless Networking, ICX, NET Health, OpenScript, and The Effortless Network are trademarks of

Brocade Communications Systems, Inc., in the United States and/or in other countries. Other brands, products, or service names

mentioned may be trademarks of their respective owners.

Notice: This document is for informational purposes only and does not set forth any warranty, expressed or implied, concerning

any equipment, equipment feature, or service offered or to be offered by Brocade. Brocade reserves the right to make changes to

this document at any time, without notice, and assumes no responsibility for its use. This informational document describes

features that may not be currently available. Contact a Brocade sales office for information on feature and product availability.

Export of technical data contained in this document may require an export license from the United States government.

The authors and Brocade Communications Systems, Inc. shall have no liability or responsibility to any person or entity with

respect to any loss, cost, liability, or damages arising from the information contained in this book or the computer programs that

accompany it.

The product described by this document may contain "open source" software covered by the GNU General Public License or other

open source license agreements. To find out which open source software is included in Brocade products, view the licensing

terms applicable to the open source software, and obtain a copy of the programming source code, please visit

http://www.brocade.com/support/oscd.

Brocade Communications Systems, Incorporated

Document History

Corporate and Latin American Headquarters

Brocade Communications Systems, Inc.

130 Holger Way

San Jose, CA 95134

E-mail: info@brocade.com

Asia-Pacific Headquarters

Brocade Communications Systems China HK, Ltd.

No. 1 Guanghua Road

Chao Yang District

Units 2718 and 2818

Beijing 100020, China

Tel: +8610 6588 8888

Fax: +8610 6588 9999

E-mail: [email protected]

European Headquarters

Brocade Communications Switzerland Sàrl

Centre Swissair

Tour B - 4ème étage

29, Route de l'Aéroport

Case Postale 105

CH-1215 Genève 15

Switzerland

Tel: +41 22 799 5640

Fax: +41 22 799 5641

E-mail: emea-i[email protected]

Asia-Pacific Headquarters

Brocade Communications Systems Co., Ltd. (Shenzhen WFOE)

Citic Plaza

No. 233 Tian He Road North

Unit 1308 – 13th Floor

Guangzhou, China

Tel: +8620 3891 2000

Fax: +8620 3891 2111

E-mail: [email protected]

Title Publication number Summary of changes Date

ServerIron ADX Security Guide 53-1002440-01 New document January, 2012

ServerIron ADX Security Guide 53-1002440-02 Corrections made to ACL

chapter

April, 2012

ServerIron ADX Security Guide 53-1002440-03 Updates made to

documentation.

June, 2012

ServerIron ADX Security Guide v

53-1002440-03

Contents

About This Document

Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii

Supported hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . xiii

Document conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii

Text formatting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii

Notes, cautions, and danger notices . . . . . . . . . . . . . . . . . . . . . xiv

Notice to the reader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv

Related publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

Getting technical help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

Chapter 1 Network Security

TCP SYN attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

IP TCP syn-proxy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Granular application of syn-proxy feature . . . . . . . . . . . . . . . . . . . . . . 2

Syn-def . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

show server traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

SYN-def-dont-send-ack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

show server debug. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

No response to non-SYN first packet of a TCP flow . . . . . . . . . . . . . . 4

Prioritizing management traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Protection against attack in hardware . . . . . . . . . . . . . . . . . . . . . 6

Peak BP utilization with TRAP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Show CPU-utilization command enhancement . . . . . . . . . . . . . . 6

BP utilization threshold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

MP utilization threshold. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

vi ServerIron ADX Security Guide

53-1002440-03

Transaction Rate Limit (TRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Understanding transaction rate limit . . . . . . . . . . . . . . . . . . . . . . 7

Configuring transaction rate limit . . . . . . . . . . . . . . . . . . . . . . . . . 8

Configuring the maximum number of rules . . . . . . . . . . . . . . . . 12

Saving a TRL configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

Transaction rate limit command reference . . . . . . . . . . . . . . . . 13

Global TRL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

TRL plus security ACL-ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

security acl-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Transaction rate limit hold-down value. . . . . . . . . . . . . . . . . . . . 15

Displaying TRL rules statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Displaying TRL rules in a policy. . . . . . . . . . . . . . . . . . . . . . . . . . 15

Displaying IP address with held down traffic . . . . . . . . . . . . . . . 16

Refusing new connections from a specified IP address . . . . . . 16

HTTP TRL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Overview of HTTP TRL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

HTTP TRL features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Configuring HTTP TRL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Configuring HTTP TRL client . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Configuring HTTP TRL defaults . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Sample HTTP TRL configuration . . . . . . . . . . . . . . . . . . . . . . . . . 20

Displaying HTTP TRL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Display all HTTP TRL policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Display HTTP TRL policy from index . . . . . . . . . . . . . . . . . . . . . .22

Display HTTP TRL policy client. . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Display HTTP TRL policy starting from index . . . . . . . . . . . . . . .23

Display HTTP TRL policy matching a regular expression. . . . . . 24

Display HTTP TRL policy client index (MP) . . . . . . . . . . . . . . . . . 24

Display HTTP TRL policy client index (BP). . . . . . . . . . . . . . . . . .25

Display HTTP TRL policy for all client entries (BP) . . . . . . . . . . .26

Downloading an HTTP TRL policy through TFTP . . . . . . . . . . . . . . . . 26

HTTP TRL policy commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Client-name <client-name> monitor-interval . . . . . . . . . . . . . . . 27

Client-name <client-name> max-conn . . . . . . . . . . . . . . . . . . . . 27

Client-name <client-name> exceed-action . . . . . . . . . . . . . . . . 28

Default monitor-interval. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Default max-conn. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Default exceed-action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Logging for DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30

Configuration commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

show server conn-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Maximum connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

clear statistics dos-attack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Maximum concurrent connection limit per client . . . . . . . . . . . . . . . 32

Limiting the number of concurrent connections per client. . . .32

ServerIron ADX Security Guide vii

53-1002440-03

Firewall load balancing enhancements. . . . . . . . . . . . . . . . . . . . . . . 34

Enabling firewall strict forwarding. . . . . . . . . . . . . . . . . . . . . . . . 34

Enabling firewall VRRPE priority . . . . . . . . . . . . . . . . . . . . . . . . . 34

Enabling track firewall group. . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Enabling firewall session sync delay. . . . . . . . . . . . . . . . . . . . . . 35

Syn-cookie threshhold trap. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Service port attack protection in hardware. . . . . . . . . . . . . . . . . . . . 35

Traffic segmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

VLAN bridging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Considerations when configuring VLAN bridging. . . . . . . . . . . . 38

Configuring VLAN bridging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Displaying VLAN bridge information . . . . . . . . . . . . . . . . . . . . . . 39

Traffic segmentation using the use-session-for-vip-mac command41

DNS attack protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Notes: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Configuring DNS attack protection . . . . . . . . . . . . . . . . . . . . . . . 43

Displaying DNS attack protection information. . . . . . . . . . . . . . 46

Chapter 2 Access Control List

How ServerIron processes ACLs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Prior to release 12.3.01 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Beginning with release 12.3.01 and later . . . . . . . . . . . . . . . . . 49

Rule-based ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

How fragmented packets are processed . . . . . . . . . . . . . . . . . . 51

Default ACL action. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Types of IP ACLs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

ACL IDs and entries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

ACL entries and the Layer 4 CAM. . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Aging out of entries in the Layer 4 CAM . . . . . . . . . . . . . . . . . . .53

Displaying the number of Layer 4 CAM entries . . . . . . . . . . . . .53

Specifying the maximum number of CAM entries for rule-based ACLs

Configuring numbered and named ACLs. . . . . . . . . . . . . . . . . . . . . . 54

Configuring standard numbered ACLs . . . . . . . . . . . . . . . . . . . . 55

Configuring extended numbered ACLs . . . . . . . . . . . . . . . . . . . . 56

Extended ACL syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Configuring standard or extended named ACLs . . . . . . . . . . . . 62

Displaying ACL definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Displaying ACLs using keywords . . . . . . . . . . . . . . . . . . . . . . . . . 64

Modifying ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Displaying a list of ACL entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

Applying an ACLs to interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Reapplying modified ACLs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

viii ServerIron ADX Security Guide

53-1002440-03

ACL logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Displaying ACL log entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Displaying ACL statistics for flow-based ACLs . . . . . . . . . . . . . . 72

Clearing flow-based ACL statistics . . . . . . . . . . . . . . . . . . . . . . . 72

Dropping all fragments that exactly match a flow-based ACL . . . . .72

Clearing the ACL statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Enabling ACL filtering of fragmented packets . . . . . . . . . . . . . . . . . . 73

Filtering fragmented packets for rule-based ACLs. . . . . . . . . . . 73

Enabling hardware filtering for packets denied by flow-based ACLs75

Enabling strict TCP or UDP mode for flow-based ACLs . . . . . . . . . . . 76

Enabling strict TCP mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

Enabling strict UDP mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Configuring ACL packet and flow counters. . . . . . . . . . . . . . . . . 78

ACLs and ICMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

Using flow-based ACLs to filter ICMP packets based on the IP packet

length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

ICMP filtering with flow-based ACLs . . . . . . . . . . . . . . . . . . . . . . 79

Using ACLs and NAT on the same interface (flow-based ACLs) . . . .82

Displaying ACL bindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

Troubleshooting rule-based ACLs. . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

Chapter 3 IPv6 Access Control Lists

IACL overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Configuration Notes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Processing of IPv6 ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Configuring an IPv6 ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Applying an IPv6 ACL to an interface . . . . . . . . . . . . . . . . . . . . . 93

Displaying ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Displaying ACLs bound to an interface. . . . . . . . . . . . . . . . . . . . 94

Using an ACL to Restrict SSH Access. . . . . . . . . . . . . . . . . . . . . . . . .94

Using an ACL to Restrict Telnet Access . . . . . . . . . . . . . . . . . . . . . . . 95

Logging IPv6 ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

Chapter 4 Network Address Translation

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Configuring NAT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Configuring static NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

Configuring dynamic NAT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

NAT configuration examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

PAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103

Forwarding packets without NAT translation. . . . . . . . . . . . . . . . . .103

ServerIron ADX Security Guide ix

53-1002440-03

Translation timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104

Configuring the NAT translation aging timer . . . . . . . . . . . . . .104

Stateless static IP NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105

Redundancy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105

Enabling IP NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106

Enabling static NAT redundancy . . . . . . . . . . . . . . . . . . . . . . . .106

Enabling dynamic NAT redundancy . . . . . . . . . . . . . . . . . . . . . 107

Displaying NAT information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Displaying NAT statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .108

Displaying NAT translation. . . . . . . . . . . . . . . . . . . . . . . . . . . . .110

Displaying NAT redundancy information. . . . . . . . . . . . . . . . . .111

Displaying VRRPE information . . . . . . . . . . . . . . . . . . . . . . . . .112

Clearing NAT entries from the table . . . . . . . . . . . . . . . . . . . . . . . . .112

Chapter 5 Syn-Proxy and DoS Protection

Understanding Syn-Proxy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .113

Syn-Proxy auto control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .113

Difference between ServerIron ADX and JetCore Syn-Proxy Behavior

113

Configuring Syn-Proxy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114

Setting a minimum MSS value for SYN-ACK packets . . . . . . . 117

Configuring Syn-Proxy auto control . . . . . . . . . . . . . . . . . . . . . .120

Displaying Syn-Proxy Commands . . . . . . . . . . . . . . . . . . . . . . .121

DDoS protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .124

Configuring a security filter . . . . . . . . . . . . . . . . . . . . . . . . . . . .125

Configuring a Generic Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . .125

Configuring a rule for common attack types. . . . . . . . . . . . . .127

Configuring a rule for ip-option attack types . . . . . . . . . . . . . .129

Configuring a rule for icmp-type options . . . . . . . . . . . . . . . . .130

Configuring a rule for IPv6 ICMP types. . . . . . . . . . . . . . . . . . .131

Configuring a rule for IPv6 ext header types . . . . . . . . . . . . . .132

Binding the filter to an interface . . . . . . . . . . . . . . . . . . . . . . . .133

Clearing DOS attack statistics. . . . . . . . . . . . . . . . . . . . . . . . . .133

Clearing all DDOS Filter & Attack Counters . . . . . . . . . . . . . . .133

Logging for DoS attacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133

Displaying security filter statistics . . . . . . . . . . . . . . . . . . . . . .134

Address-sweep and port-scan logging . . . . . . . . . . . . . . . . . . .134

xServerIron ADX Security Guide

53-1002440-03

Chapter 6 Secure Socket Layer (SSL) Acceleration

SSL overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135

Public Key Infrastructure (PKI) . . . . . . . . . . . . . . . . . . . . . . . . .135

Asymmetric cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136

Certificate Authority (CA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136

Certificate Revocation List (CRL) . . . . . . . . . . . . . . . . . . . . . . .136

Cipher suite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136

Digital certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136

Digital signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136

Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136

Key pair. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136

Private key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136

Public key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137

SSL acceleration on the ServerIron ADX . . . . . . . . . . . . . . . . . . . . .137

SSL Termination Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137

SSL Proxy Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138

ServerIron ADX SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138

Configuring SSL on a ServerIron ADX . . . . . . . . . . . . . . . . . . . . . . .140

Obtaining a ServerIron ADX keypair file . . . . . . . . . . . . . . . . . .140

Certificate management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

Converting certificate formats. . . . . . . . . . . . . . . . . . . . . . . . . . 147

Importing keys and certificates. . . . . . . . . . . . . . . . . . . . . . . . .148

Support for SSL renegotiation. . . . . . . . . . . . . . . . . . . . . . . . . .164

Basic SSL profile configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . .164

Specifying a keypair file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165

Specifying a cipher suite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165

Specifying a certificate file . . . . . . . . . . . . . . . . . . . . . . . . . . . .166

Advanced SSL profile configuration. . . . . . . . . . . . . . . . . . . . . . . . .166

Configuring client authentication . . . . . . . . . . . . . . . . . . . . . . .166

Enabling session caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170

Configuring session cache size. . . . . . . . . . . . . . . . . . . . . . . . .170

Configuring a session cache timeout . . . . . . . . . . . . . . . . . . . . 171

Enabling SSL Version 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

Enabling close notify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

Disabling certificate verification . . . . . . . . . . . . . . . . . . . . . . . . 171

Enabling a ServerIron ADX SSL to respond with renegotiation

headers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172

Configuring Real and Virtual Servers for SSL Termination and Proxy Mode

172

Configuring Real and Virtual Servers for SSL Termination Mode173

Configuring Real and Virtual Servers for SSL Proxy Mode . . . 174

Configuration Examples for SSL Termination and Proxy Modes . . 176

Configuring SSL Termination Mode . . . . . . . . . . . . . . . . . . . . . 176

Configuring SSL Proxy Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

TCP configuration issues with SSL Terminate and SSL Proxy .178

Other protocols supported for SSL . . . . . . . . . . . . . . . . . . . . . .184

Configuring the system max values . . . . . . . . . . . . . . . . . . . . .185

ServerIron ADX Security Guide xi

53-1002440-03

SSL debug and troubleshooting commands . . . . . . . . . . . . . . . . . .187

Diagnostics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187

Displaying SSL information . . . . . . . . . . . . . . . . . . . . . . . . . . . .188

Displaying the status of a CRL record . . . . . . . . . . . . . . . . . . .191

Displaying socket information . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199

Displaying SSL Statistics information . . . . . . . . . . . . . . . . . . . .201

Displaying TCP IP information . . . . . . . . . . . . . . . . . . . . . . . . . .205

ASM SSL dump commands. . . . . . . . . . . . . . . . . . . . . . . . . . . .209

xii ServerIron ADX Security Guide

53-1002440-03

This manual suits for next models

Table of contents

Other Brocade Communications Systems Switch manuals