GigaSMART SSL Decryption for Inline and Out-of-Band Tools

Required License: SSL Decryption for Inline and Out-of-Band Tools

SSL decryption for inline and out-of-band tools is described in Inline SSL Decryption. It is supported on all GigaVUE‑HC1, GigaVUE‑HC2, and GigaVUE‑HC3 devices.

Configuring SSL Decryption Examples

The following sections provide examples of SSL decryption. Refer to the following:

■   Example 1: SSL Decryption with a Regular Map on page 613
■   Example 2: SSL Decryption with De-duplication on page 615
■   Other Usage Examples on page 615

In Example 1, a regular map is configured to use with the SSL decryption GigaSMART operation.

Step

Description

Command
1.    

Upload a key and create a service. Refer to Working with Keys and Services on page 609.

(config) # apps ssl key alias key1 download type private-key url https://keyserver.domain.com/path/keyfile.pem

(config) # apps ssl service alias service1 server-ip 192.168.1.1 server-port 443

2.  

Configure a GigaSMART group..

(config) # gsgroup alias gsgrp1 port-list 1/1/e1

3.  

Specify the GigaSMART group alias.

(config) # gsparams gsgroup gsgrp1

4.  

Specify a failover action.

(config gsparams gsgroup gsgrp1) # ssl-decrypt decrypt-fail-action drop

5.  

Configure session timeouts, in seconds.

(config gsparams gsgroup gsgrp1) # ssl-decrypt pending-session-timeout 60

(config gsparams gsgroup gsgrp1) # ssl-decrypt session-timeout 300

(config gsparams gsgroup gsgrp1) # ssl-decrypt tcp-syn-timeout 20

6.  

Configure cache timeouts, in seconds.

(config gsparams gsgroup gsgrp1) # ssl-decrypt key-cache-timeout 9000

(config gsparams gsgroup gsgrp1) # ssl-decrypt ticket-cache-timeout 9000

7.  

Configure a key/service mapping that maps how a key is assigned to an IP address of a server.

(config gsparams gsgroup gsgrp1) # ssl-decrypt key-map add service service1 key key1

8.  

Enable SSL decryption.

(config gsparams gsgroup gsgrp1) # ssl-decrypt enable

9.  

Exit the GigaSMART group configuration mode.

(config gsparams gsgroup gsgrp1) # exit

(config) #

10.  

Configure a GigaSMART operation for SSL decryption.

(config) # gsop alias gdssl1 ssl-decrypt in-port any out-port auto port-list gsgrp1

In the previous step, gdssl1 is the alias for a GigaSMART operation, in-port specifies the destination port on which to listen, out-port specifies the destination port on which to send decrypted traffic, and port-list is set to the GigaSMART group alias previously configured. The in-port and out-port arguments can also be a port number between 1 and 65535.

Next, configure a traffic map, as follows:

Step

Description

Command
1.    

Specify a map alias (m1) and specify the map type and subtype.

(config) # map alias m1

(config map alias m1) # type regular byRule

2.  

Specify the GigaSMART operation alias (gdssl1) as part of the map. This applies the associated GigaSMART functionality to packets matching a rule in the map.

(config map alias m1) # use gsop gdssl1

3.  

Specify a map rule.

(config map alias m1) # rule add pass ipver 4

4.  

Specify the destination for packets matching this map.

(config map alias m1) # to 1/1/g2

5.  

Specify the source leader in a bidirectional clock relationship (formerly master) port(s) for this map.

(config map alias m1) # from 1/1/g1

6.  

Exit the map prefix mode.

(config map alias m1) # exit

(config) #

7.  

Display the configuration.

(config) # show gsop

(config) # show map

(config) # show gsparams

In Example 2, the configuration steps are the same except when you configure a GigaSMART operation you send the decrypted traffic to de-duplication for additional filtering, as follows:

(config) # gsop alias gdssl1 ssl-decrypt in-port any out-port auto dedup set port-list gsgrp1

Two typical usage examples are as follows:

■   Use map rules to filter on the IP address of the server and send everything to GigaSMART. Configure a GigaSMART operation to listen on the in-port used by the server. The GigaSMART will drop other traffic.
■   Use map rules to filter on the IP address of the server and in-port and send specific port traffic to the GigaSMART. Configure a GigaSMART operation to listen on in-port any.