It's Possible To Disable TLS in vManage or Controllers

[ADC Lane]

Hi Team, 

Default, SDWAN devices use DTLS to encryt packet (vedge, vmanage, vmart, vbond). So if I use DTLS, TLS can be disabled  or TLS still available ? And i wonder that are there any way to disable TLS if i want ?

Thank you in advance !

[Kanan Huseynli]

Hi,

control connection to vBond (from vSmart/vManage/cEdge) is always DTLS based. vBond does not support TLS.

Based on configuration of vSmart and vManage, control connection from cEdge to them and between each other can be DTLS or TLS. In configuration it is either DTLS or TLS, there is no "both" option. But if one device is DTLS other device is TLS, then TLS is chosen between them.

This section of CVD describes in detail:

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#ControlConnections

To disable TLS, just configure all vSmart and vManage to use DTLS under security configuration (template or CLI).

[ADC Lane]

Hi @Kanan Huseynli ,

Default vSmart and vManage use DTLS, if I dont change DTLS to TLS, they will use DTLS and TLS is disabled, is it right ?

If its right, when I show port open in vmanage, TLS is still open ? I am confuse ....

[Kanan Huseynli · Accepted solution]

Hi,

the reason is, vSmart can be configured for TLS, then between vSmart and vManage security protocol will be TLS (even though DTLS is configured on vManage). Thus, vManage needs to open respective ports in daemon.

I don't see any option to disable (totally) TLS or DTLS at OS level. If yuo have security concerns, block those ports on firewall level.

Below is ports used by SD-WAN elements:

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#FirewallPortConsiderations

[ADC Lane]

@Kanan Huseynli Thank you so much ! I am appreciate it !