HP A5830 Series, Руководство по настройке

Страница: 210 / 280

202
To do... Use the command... Remarks
2. Create an SSL server policy
and enter its view.
ssl server-policy
policy-name Required.
3. Specify a PKI domain for the
SSL server policy.
pki-domain domain-name
Required.
By default, no PKI domain is
specified for an SSL server policy.
4. Specify the cipher suites for
the SSL server policy to
support.
ciphersuite [
rsa_3des_ede_cbc_sha |
rsa_aes_128_cbc_sha |
rsa_aes_256_cbc_sha |
rsa_des_cbc_sha |
rsa_rc4_128_md5 |
rsa_rc4_128_sha ] *
Optional.
By default, an SSL server policy
supports all cipher suites.
5. Set the handshake timeout
time for the SSL server.
handshake timeout time
Optional.
3600 seconds by default.
6. Set the SSL connection close
mode.
close-mode wait
Optional.
Not wait by default.
7. Set the maximum number of
cached sessions and the
caching timeout time.
session { cachesize size | timeout
time } *
Optional.
The defaults are as follows:
• 500 for the maximum number
of cached sessions,
• 3600 seconds for the caching
timeout time.
8. Configure the server to
require certificate-based SSL
client authentication.
client-verify enable
Optional.
By default, the SSL server does not
require the client to be
authenticated.
9. Enable SSL client weak
authentication.
client-verify weaken
Optional.
Disabled by default.
This command takes effect only
when the client-verify enable
command is configured.
If you enable client authentication here, you must request a local certificate for the client.
SSL mainly comes in these versions: SSL 2.0, SSL 3.0, and TLS 1.0, where TLS 1.0 corresponds to SSL
3.1. When the switch acts as an SSL server, it can communicate with clients running SSL 3.0 or TLS 1.0,
and it can identify Hello packets from clients running SSL 2.0. If a client running SSL 2.0 also supports
SSL 3.0 or TLS 1.0 (information about supported versions is carried in the packet that the client sends to
the server), the server notifies the client to use SSL 3.0 or TLS 1.0 to communicate with the server.
SSL server policy configuration example
Network requirements
As shown in Figure 65 , users can access and control the switch through web pages. For security of the
switch, users must use HTTPS to log in to the web interface of the switch and use SSL for identity
authentication to make sure that data is not eavesdropped or tampered with.