11-23-2010 07:42 AM
Hi All,
is there anyone who has configured SSL termination with client authentication on Cisco 4710 ACE platform, I have seen the link below to figure out that possible in ACE module, what about the ACE appliance?
Could any one please let me know how to enable that feature on the ACE 4710? is this possible?
I already have SSL offloading working on it but now going to implement a new VIP on it and for this purpose I would need help on how to configure it, can anyone suggest something here?
Thanks for your help in advance.
Regds,
Farhan
11-24-2010 12:54 AM
Hi Farhan,
Yes, it's also possible to have client authentication working on the ACE appliance.
The configuration is basically the same as in the module, but, for more details, please refer to http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/ssl/guide/terminat.html#wp1117637
Best regards
Daniel
11-24-2010 01:44 AM
Thanks Daniel for this, actually I also had got the
pdf for SSL termination, but it didnt contain the required information, now from the link you
gave, it has the required configuration .
Thanks for your help.
Regds,
Farhan
11-25-2010 08:33 AM
Hi there,
does any know the right procedure to enable the CRL in one armed mode configuration, I dont have any DNS server to resolve the webserver name where the CRL is kept.
though I can define the http://x.x.x.x/crl.crl, what its not working.
Could any one help, please.
Regds,
Farhan
11-27-2010 09:52 AM
Could you please provide the configuation you applied to make the ACE download the CRL?
What does the output to the "show crypto crl
FYI, you may want to consider upgrading from A3(2.2) to get the fix for:
"CSCsy01905—Some SSL connections may continue to be accepted in the ACE even though the reference CRL, against which the revocation check is to be performed, has been removed. When the signature verification for the CRL fails, the CRL is removed from the ACE because it is considered untrusted. There may be some connections that have been accepted in the ACE prior to enabling signature verification of CRL. The fresh SSL connections with those client certificates continue to be accepted even though the reference CRL against which the revocation checks were performed have been removed as a result of a signature verification failure. "
It was first fixed in A3(2.3). There is also an outstanding defect that is not fixed in the A3 train, but has a workaround. It is however fixed in the new A4 train:
"CSCta74000—The ACE may fail to download a certificate revocation list (CRL). In some cases, the CRL fails to download when it is reapplied to the SSL proxy that is being used in certain VIPs if the previous applications to the SSL proxy had failed to download the same CRL at the point when the CRL server was down. When this situation occurs, the ACE stops downloading the CRL. Workaround: Unconfigure and then reconfigure the CRL again. "
12-09-2010 07:40 AM
Hi there, thanks for your help, I upgraded the version to 3.2.6 and its working as expected. However one more question arises here, to refresh the CRL entry from the server after the certain internal like it happens in CSS, that you can configure the interval like:
ssl crl-record crl < crl name>
is that possible in ACE 4710 ?
Regds,
Farhan
01-26-2011 08:47 AM
Any info about the CRL loading timeliness on ACE? any one?
Regds,
Farhan
01-26-2011 09:29 AM
Hello Farhan,
here:
are discussed the events that produce a CRL download, basically it is governed by the "Next Update" field present in the CRL itself (on the next client authentication occurring after the last Next Update date has been reached).
Hope it helps,
Francesco
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide