apps inline-ssl

Creates an SSL keychain password as follows:

(config) # apps inline-ssl keychain password

Creating a new password for ssl keychain:

Password: *********

Confirm: *********

The password is used to encrypt all cryptographic materials such as certificates and private keys uploaded to the node. Passwords are not saved on the node.

Passwords must be at least 8 characters (up to 64 characters) and must include at least one of each of the following:

Note:  The keychain password must be configured before installing certificates and keys. If the key has a passphrase, in order to install it, the keychain password and the passphrase must match.

Resets an SSL keychain password. When keys are installed on the node, a warning is displayed.

Note:  Resetting the password revokes all existing private keys.

For example:

(config) # apps inline-ssl keychain password reset

WARNING: Password is already set. Reset password will revoke all existing private keys.

Password: *********

Confirm: *********

Specifies the SSL minimum version and maximum version as follows:

The default minimum version is sslv3. The default maximum version is tls12. Ensure the minimum version is less than the maximum version.

For example:

(config) # apps inline-ssl min-version tls11 max-version tls12

Allows or drops above TLS maximum version for the given configuration as follows:

The default maximum version is tls13.

When you enable the split proxy settings for an inline SSL profile, it divides the TLS connection between the server and client into two independent connections and keeps the security parameters separate.

For example:

(config) # apps inline-ssl profile alias sslprofile split-proxy enable​

Allows the inline tools to change the MAC address or VLAN IDs. When a connection request is received from the client, GigaSMART establishes the connection with the inline tool first, before connecting with the server. This helps the inline tools to modify the MAC address or VLAN IDs when sending the traffic back to the server.

For additional information and limitations, refer to the "Tool Early Engage and One-Arm Mode" section in the GigaVUE-FM User's Guide.

For example:

(config) # apps inline-ssl profile alias sslprofile tool early-engage enable​

Allows both the client and server traffic to travel through the same physical link or logical aggregate port channel.

Note:  You can enable the one-arm mode only if you have enabled the tool early-engage option.

For additional information and limitations, refer to the "Tool Early Engage and One-Arm Mode" section in the GigaVUE-FM User's Guide.

For example:

(config) # apps inline-ssl profile alias sslprofile one-arm enable​

Configures the handling of expired, invalid, self-signed, and unknown CA certificates as well as enabling or disabling certificate revocation for the profile as follows:

The revocation check is disabled by default. The connection is permitted, at least until the revocation check returns the status.

Examples:

(config apps inline-ssl profile alias sslprofile) # certificate expired decrypt

(config apps inline-ssl profile alias sslprofile) # certificate invalid drop

(config apps inline-ssl profile alias sslprofile) # certificate revocation crl disable

(config apps inline-ssl profile alias sslprofile) # certificate revocation ocsp enable fail soft

Specifies additional configuration options for the decrypt action for the profile. This is the action to take if the match action is to decrypt as follows:

The default is disable, which means that all decrypted SSL traffic is sent to the tools.

Examples:

(config apps inline-ssl profile alias sslprofile) # decrypt tool-bypass enable

(config apps inline-ssl profile alias sslprofile) # decrypt tcp inactive-timeout 10

(config apps inline-ssl profile alias sslprofile) # decrypt tcp portmap override-port disable

apps inline-ssl profile alias sslprofile decrypt tcp portmap default-out-port 12

Refer to “Inline SSL Decryption Port Map” section in the GigaVUE Fabric Management Guide for details.

Fetches the no-decrypt list or the decrypt list text file for the profile from the specified URL as follows:

No-decrypt list entries are implicitly set to no-decrypt, which means that as a policy, no-decrypt listed domains and hostnames will always be bypassed for decryption.

As a policy, hostnames or domains matching the decrypt list entries will always be decrypted.

No-decrypt list and decrypt list text files must adhere to the following:

The supported formats for fetch are: SCP, SFTP, FTP, HTTP.

For example:

(config apps inline-ssl profile alias sslprofile) # fetch nodecryptlist http://1.1.1.1/temp/whitelist.txt

Creates an SSL server key map, which creates a key map entry. A server key map is for an inbound deployment of inline SSL decryption, in which the customer has the server keys.

A server key map binds keys from the keystore as follows:

Note:  IPV6 traffic decryption is supported only for GEN 3 cards. Refer to the GigaVUE-HC1 Hardware Installation Guide and GigaVUE-HC3 Hardware Installation Guide for the list of GEN 3 card numbers.

The maximum number of key mappings is 1000.

Examples:

(config apps inline-ssl profile alias sslprofile) # keymap add server server_1 key server_1_key

(config apps inline-ssl profile alias sslprofile) # keymap add server server_2 key server_2_key

(config apps inline-ssl profile alias sslprofile) # keymap add server server_3 key server_3_key

(config apps inline-ssl profile alias sslprofile) # keymap add server server_4 key server_4_key

Note:  Use the apps keystore command to add server keys to the key store. Refer to apps keystore.

Enables or disables inline network group multiple entry for the profile. The default is disabled.

An inline network group topology can have multiple network port pairs (for example, Na1, Nb1 and Na2, Nb2). With multiple network port pairs, traffic from a network interface might traverse GigaSMART multiple times. Intercepted traffic from GigaSMART might reenter GigaSMART through a different network interface within the same network group.

Starting in software version 5.3, the same traffic sent from GigaSMART can reenter GigaSMART.

GigaSMART remembers the inline incoming inline network interface (for example, Na1) for each connection. When traffic from the same connections reaches GigaSMART with a different inline network interface (for example, Na2) within the same network group, GigaSMART will forward the traffic to the corresponding opposite network interface (for example, Nb2), without further processing. This allows traffic from the same connection to reenter GigaSMART.

However, the same traffic sent by GigaSMART reentering through the same network port pair (for example, Nb2, Na2) is not supported.

For example:

(config apps inline-ssl profile alias sslprofile) # network-group multiple-entry enable

Specifies a non-SSL TCP action as follows:

The default is disable, which means that all non-SSL traffic is sent to the tools.

For example:

(config apps inline-ssl profile alias sslprofile) # non-ssl-tcp tool-bypass enable

Deletes rules for the profile, either all rules or a specific rule by its rule ID.

Examples:

(config apps inline-ssl profile alias sslprofile) # rule delete all

(config apps inline-ssl profile alias sslprofile) # rule delete rule-id 2

Specifies an action to take for the profile. This is the action to take on the traffic if GigaSMART is unable to resolve the URL category information locally. The actions are as follows:

The default is no-decrypt.

Examples:

(config apps inline-ssl profile alias sslprofile) # url-cache miss action decrypt

(config apps inline-ssl profile alias sslprofile) # url-cache miss action defer

(config apps inline-ssl profile alias sslprofile) # url-cache miss action defer timeout 5

Reserved for internal use.

# show apps inline-ssl caching certificate validation status

# show apps inline-ssl caching url status

# show apps inline-ssl monitor session any

# show apps inline-ssl monitor summary

# show apps inline-ssl profile alias sslprofile decryptlist BadCo.com

# show apps inline-ssl profile all

# show apps inline-ssl session debug

# show apps inline-ssl session match ipv4-src 126.1.0.141/21 ipv4-dst 126.1.0.22/29 l4port-src any l4port-dst any hostname gigamon.com

# show apps inline-ssl session match ipv4-src 192.168.1.1/24 ipv4-dst 192.168.1.2/24 l4port-src 56708 l4port-dst 443 hostname gigamon.com detail

# show apps inline-ssl session match hostname gigamon.com detail

# show apps inline-ssl trust-store all

(config) # no apps inline-ssl profile alias sslprofile

(config) # no apps inline-ssl signing rsa for primary

(config) # no apps inline-ssl signing rsa for secondary

(config) # clear apps inline-ssl caching cert-validation