R3721-F3210-F3171-HP High-End Firewalls Network Management Configuration Guide-6PW101

Table Of Contents

912

NOTE:

SSL mainly comes in these versions: SSL 2.0, SSL 3.0, and TLS 1.0, where TLS 1.0 corresponds to SSL 3.1.

hen the switch acts as an SSL server, it can communicate with clients runnin

SSL 3.0 or TLS 1.0, and

can identify the SSL 2.0 Client Hello message from a client supportin

SSL 2.0 and SSL 3.0/TLS 1.0 and

notify the client to use SSL 3.0 or TLS 1.0 to communicate with the server. In FIPS mode, only TLS 1.0 is

supported.

SSL server policy configuration example

Network requirements

As shown in Figure 405, users need to access and control the device through web pages.

For security of the device and to make sure that data is not eavesdropped or tampered with, configure the

device so that users must use HTTPS (Hypertext Transfer Protocol Secure, which uses SSL) to log in to the

web interface of the device.

NOTE:

• In this example, Windows Server works as the CA server and the Simple Certificate Enrollment Protocol

(SCEP) plug-in is installed on the CA server.

• Before performing the following configurations, make sure that Firewall, the host, and the CA server

have IP connectivity between each other.

Figure 405 Network diagram

Configuration considerations

To achieve the goal, perform the following configurations:

• Configure Firewall to work as the HTTPS server and request a certificate for Firewall.

• Request a certificate for Host so that Firewall can authenticate the identity of Host.

• Configure a CA server to issue certificates to Firewall and Host.

Configuration procedure

1. Configure the HTTPS server (Firewall):

# Create a PKI entity named en, and configure the common name as http-server1 and the FQDN

as ssl.security.com.

<Firewall> system-view

[Firewall] pki entity en

[Firewall-pki-entity-en] common-name http-server1

[Firewall-pki-entity-en] fqdn ssl.security.com