Cisco IE 4000, Software Configuration Manual

Page: 167 / 1066

163
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
Secure HTTP Servers and Clients
On a secure HTTP connection, data to and from an HTTP server is encrypted before being sent over the Internet. HTTP
with SSL encryption provides a secure connection to allow such functions as configuring a switch from a Web browser.
Cisco's implementation of the secure HTTP server and secure HTTP client uses an implementation of SSL Version 3.0
with application-layer encryption. HTTP over SSL is abbreviated as HTTPS; the URL of a secure connection begins with
https:// instead of http://.
The primary role of the HTTP secure server (the switch) is to listen for HTTPS requests on a designated port (the default
HTTPS port is 443) and pass the request to the HTTP 1.1 Web server. The HTTP 1.1 server processes requests and
passes responses (pages) back to the HTTP secure server, which responds to the original request.
The primary role of the HTTP secure client (the web browser) is to respond to Cisco IOS application requests for HTTPS
User Agent services, perform HTTPS User Agent services for the application, and pass the response back to the
application.
When SSL is used in a switch cluster, the SSL session terminates at the cluster commander. Cluster member switches
must run standard HTTP.
For secure HTTP connections, we recommend that you configure an official CA trustpoint. A CA trustpoint is more secure
than a self-signed certificate.
Before you configure a CA trustpoint, you should ensure that the system clock is set. If the clock is not set, the certificate
is rejected due to an incorrect date.
Default SSL Settings
Certificate Authority Trustpoints
Certificate authorities (CAs) manage certificate requests and issue certificates to participating network devices. These
services provide centralized security key and certificate management for the participating devices. Specific CA servers
are referred to as
trustpoints .
When a connection attempt is made, the HTTPS server provides a secure connection by issuing a certified X.509v3
certificate, obtained from a specified CA trustpoint, to the client. The client (usually a Web browser), in turn, has a public
key that allows it to authenticate the certificate.
For secure HTTP connections, we highly recommend that you configure a CA trustpoint. If a CA trustpoint is not
configured for the device running the HTTPS server, the server certifies itself and generates the needed RSA key pair.
Because a self-certified (self-signed) certificate does not provide adequate security, the connecting client generates a
notification that the certificate is self-certified, and the user has the opportunity to accept or reject the connection. This
option is useful for internal network topologies (such as testing).
If you do not configure a CA trustpoint, when you enable a secure HTTP connection, either a temporary or a persistent
self-signed certificate for the secure HTTP server (or client) is automatically generated.
Table 28 Default SSL Settings
Default Setting
The standard HTTP server is enabled.
SSL is enabled.
No CA trustpoints are configured.
No self-signed certificates are generated.