RedMax EXtreme EX-LRT Guía para resolver problemas descargar pdf (Pagina 32)

Oracle SBC Security Guide

 A Signaling Security Module (SSM) daughter card is required for cryptographic acceleration

when using TLS (with the exception of the NN38xx platforms under 500 sessions)

 Certificate key lengths can go up to 2048 bits, with 4096 possible with SSM3 (currently on

supported on 6300) after SC7.2.

 Certificates are currently signed with a SHA-1 hash. It is recognized that this needs to be updated

to a SHA-2 algorithm. When the FIPS license is applied SHA-256 is used instead.

 If site-to-site failover is required, the main site’s fully qualified domain name (FQDN) and the

FQDN for any alternate site should be specified as alternate-names in the certificate record prior

to CSR generation.

 TLS session caching (tls-global element) allows a previously authenticated user to reuse a

previous session so authentication is sped up. This may help reduce time to recovery due to

outages, though it is best suited for environments where user IP does not vary significantly.

The default cipher list when creating a tls-profile is currently “ALL”. This includes potentially

insecure ciphers and a “NONE” cipher which does not provide encryption - only authentication.

When configuring a tls-profile, use the following ciphers for maximum security:

For release SC7.2 and above:

 TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384

 TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256

 TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256

 TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256

For SC7.2 and below:

 TLS_DHE_RSA_WITH_AES_256_CBC_SHA

 TLS_DHE_RSA_WITH_AES_128_CBC_SHA

Since TLS is based on TCP, TCP DoS protections should be configured to limit the number of

connections per source IP and per sip-interface. Consider these settings in your environment:

 sip-config > inactive-dynamic-conn – Defines global timer for tearing down idle TCP/TLS

connections where no SIP data has been sent. The timer used is twice as long for TLS.

 sip-interface settings to limit connections:

o untrusted-conn-timeout – Closes socket if untrusted entity does not become trusted, such

as if the register didn’t complete.

o inactive-conn-timeout – Tears down idle TCP/TLS connections when no further data is

being sent, such as if a trusted host sends an INVITE but nothing else.

o max-incoming-conns – Set to max incoming sessions you want the SIP interface to host

plus overhead for setup / teardown (depends on call rate).

o per-src-ip-max-incoming-conns – Usually 1 or 2 but affected by NAT use and

application.

Configuration is detailed in Section 15 “Security” of the ACLI Configuration Guide.

OCSP

The Online Certificate Status Protocol (OCSP) is defined in RFC 2560, X.509 Internet Public Key

Infrastructure Online Certificate Status Protocol - OCSP. The protocol enables users to determine the

revocation state of a specific certificate, and may provide a more efficient source of revocation

information than is possible with Certificate Revocation Lists (CRL).

1 2 ... 27 28 29 30 31 32 33 34 35 36 37 ... 141 142

Comentarios a estos manuales

Sin comentarios

RedMax EXtreme EX-LRT Guía para resolver problemas Pagina 32

Comentarios a estos manuales

Relacionado con productos y manuales para Cortadoras De Césped RedMax EXtreme EX-LRT