R3721-F3210-F3171-HP High-End Firewalls Network Management Configuration Guide-6PW101

911
To configure an SSL server policy:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Create an SSL server policy
and enter its view.
ssl server-policy policy-name N/A
3. Specify a PKI domain for the
SSL server policy.
pki-domain domain-name
By default, no PKI domain is
specified for an SSL server policy.
If the client requires
certificate-based authentication for
the SSL server, you must use this
command to specify a PKI domain
for the server and request a local
certificate for the server through the
PKI domain.
4. Specify the cipher suite(s) for
the SSL server policy to
support.
• In non-FIPS mode:
ciphersuite
[ dhe_rsa_aes_128_cbc_sha |
dhe_rsa_aes_256_cbc_sha |
rsa_3des_ede_cbc_sha |
rsa_aes_128_cbc_sha |
rsa_aes_256_cbc_sha |
rsa_des_cbc_sha |
rsa_rc4_128_md5 |
rsa_rc4_128_sha ] *
• In FIPS mode:
prefer-cipher
{ dhe_rsa_aes_128_cbc_sha |
dhe_rsa_aes_256_cbc_sha |
rsa_aes_128_cbc_sha |
rsa_aes_256_cbc_sha }
Optional.
By default, an SSL server policy
supports all cipher suites.
Support for the commands
depends on the firewall model. For
more information, see the SSL
command reference.
5. Set the handshake timeout
time for the SSL server.
handshake timeout time
Optional.
3600 seconds by default.
6. Set the SSL connection close
mode.
close-mode wait
Optional.
Not wait by default.
7. Set the maximum number of
cached sessions and the
caching timeout time.
session { cachesize size | timeout
time } *
Optional.
The defaults are as follows:
• 500 for the maximum number
of cached sessions,
• 3600 seconds for the caching
timeout time.
8. Enable the SSL server to
perform digital
certificate-based
authentication for SSL clients.
client-verify enable
Optional.
By default, the SSL server does not
require client to be authenticated.
9. Enable SSL client weak
authentication.
client-verify weaken
Optional.
Disabled by default.
This command takes effect only
when the client-verify enable
command is configured.