Validated Reference Design NetScaler SSL Profiles

Transcription

1 Validated Reference Design NetScaler SSL Profiles This guide focuses on providing guidelines to customers on implementing NetScaler SSL Profiles based on their use cases. Citrix.com 1

2 Table of Contents Overview 3 NetScaler Summary 3 Overview NetScaler SSL Profiles 3 SSL Profiles Use Cases 5 SSL Default Profiles 5 Note 6 Use Case 1 7 Use Case 2 8 Custom SSL Profiles 9 SSL Front End Profiles 10 SSL Back End Profiles 10 Citrix.com Validated Reference Guide for NetScaler SSL Profiles 2

3 Overview NetScaler Summary Citrix NetScaler is an all-in-one application delivery controller that makes applications run up to five times better, reduces application ownership costs, optimizes the user experience and ensures that applications are always available by using: Advanced L4-7 load balancing and traffic management Proven application acceleration such as HTTP compression and caching An integrated application firewall for application security Server offloading to significantly reduce costs and consolidate servers As an undisputed leader of service and application delivery, Citrix NetScaler is deployed in thousands of networks around the world to optimize, secure and control the delivery of all enterprise and cloud services. Deployed directly in front of web and database servers, NetScaler combines high-speed load balancing and content switching, http compression, content caching, SSL acceleration, application flow visibility and a powerful application firewall into an integrated, easy-to-use platform. Meeting SLAs is greatly simplified with end-toend monitoring that transforms network data into actionable business intelligence. NetScaler allows policies to be defined and managed using a simple declarative policy engine with no programming expertise required. Overview NetScaler SSL Profiles You can use an SSL profile to specify how a NetScaler ADC processes SSL traffic. The profile is a collection of SSL parameter settings for SSL entities, such as virtual servers, services, and service groups, and offers ease of configuration and flexibility. You are not limited to configuring only one set of global parameters. You can create multiple sets (profiles) of global parameters and assign different sets to different SSL entities. SSL profiles are classified into two categories: o o Front-end profiles, containing parameters applicable to the front-end entity. That is, they apply to the entity that receives requests from a client. Back-end profiles, containing parameters applicable to the back-end entity. That is, they apply to the entity that sends client requests to a server. Unlike a TCP or HTTP profile, an SSL profile is optional. Once SSL Profiles (a global parameter) is enabled, all SSL endpoints inherit default profiles. The same profile can be reused across multiples entities. If an entity does not have a profile attached, the values set at the global level apply. For dynamically learned services, current global values apply. Compared to the alternate way that requires configuration of SSL parameters, ciphers and ECC curves on individual SSL endpoints, SSL Profiles on NetScaler simplify configuration management by acting as a single point of SSL configuration for all related endpoints. Furthermore, configuration problems such as cipher reordering and downtime when ciphers are reordered are solved with the use of SSL Profiles. SSL Profiles help in setting required SSL parameters and cipher bindings on those SSL endpoints on which traditionally one could not set these parameters and bindings. SSL Profiles can be set on secure monitors as well. Citrix.com Validated Reference Guide for NetScaler SSL Profiles 3

4 The following table lists the parameters that are part of each profile. Front End Profile cipherredirect, cipherurl cleartextport* clientauth, clientcert denysslreneg dh, dhfile, dhcount dropreqwithnohostheader encrypttriggerpktcount ersa, ersacount insertionencoding nonfipsciphers pushenctrigger pushenctriggertimeout pushflag quantumsize Backend Profile denysslreneg encrypttriggerpktcount nonfipsciphers pushenctrigger pushenctriggertimeout pushflag quantumsize serverauth commonname sessreuse, sesstimeout SNIEnable ssl3 ssltriggertimeout strictcachecks redirectportrewrite TLS 1.0, TLS 1.1, TLS 1.2 sendclosenotify sessreuse, sesstimeout SNIEnable ssl3 sslredirect ssltriggertimeout strictcachecks tls1, tls11, tls12 Citrix.com Validated Reference Guide for NetScaler SSL Profiles 4

5 * The cleartextport parameter applies only to an SSL virtual server. An error message appears if you try to set a parameter that is not part of the profile (for example, if you try to set the clientauth parameter in a backend profile). Some SSL parameters, such as CRL memory size, OCSP cache size, UndefAction Control, and UndefAction Data, are not part of any of the above profiles, because these parameters are independent of entities. These parameters are present in Traffic Management -> SSL -> Advanced SSL Settings. An SSL profile supports the following operations: Add Creates an SSL profile on the NetScaler ADC. Specify whether the profile is front end or back end. Front end is the default. Set Modifies the settings of an existing profile. Unset Sets the specified parameters to their default values. If you do not specify any parameters, an error message appears. If you unset a profile on an entity, the profile is unbound from the entity. Remove Deletes a profile. A profile that is being used by any entity cannot be deleted. Clearing the configuration deletes all the entities. As a result, the profiles are also deleted. Bind Binds a profile to a Vserver. Unbind Unbinds a profile from a Vserver. Show Displays all the profiles that are available on the NetScaler ADC. If a profile name is specified, the details of that profile are displayed. If an entity is specified, the profiles associated with that entity are displayed. SSL Profiles Use Cases SSL Default Profiles NetScaler appliances come with two in-built default profiles 1. ns_default_ssl_profile_frontend default front-end profile for all SSL type virtual servers and Inter nal services. 2. ns_default_ssl_profile_backend default back-end profile for SSL type services, service groups and secure monitors. Any new endpoint created gets corresponding default SSL profile bound. It is possible to change the SSL parameters and ciphers of default SSL profiles. This ensures that customers can change the settings and bindings at one point which gets referenced by corresponding endpoints. Important Save your configuration before you upgrade the software and enable the default profiles. Upgrade the software to a build that supports the enhanced profile infrastructure, and then enable the default profiles. You can take one of two approaches depending on your specific deployment. If your deployment has a common SSL configuration across end points, see Use Case 1. If your deployment has a large SSL configuration and the SSL parameters and ciphers are not common among end points, see Use Case 2. Citrix.com Validated Reference Guide for NetScaler SSL Profiles 5

6 Important After upgrading the software, if you enable the profile, you cannot reverse the changes. That is, the profile cannot be disabled. Therefore, the only way to reverse the change is to reboot using the old configuration. Note A single operation (Enable Default Profile or set ssl parameter -defaultprofile ENABLED) enables (binds) both the default front-end profile and the default back-end profile. Note Default SSL profiles is now available for clustering starting from v11.1 To save the configuration by using the NetScaler command line At the command prompt, type: > save config > shell root@ns# cd /nsconfig root@ns# cp ns.conf ns.conf.ns<currentreleasenumber><currentbuildnumber> EXAMPLE > save config > shell root@ns# cd /nsconfig root@ns# cp ns.conf ns.conf.ns<currentreleasenumber><currentbuildnumber> Citrix.com Validated Reference Guide for NetScaler SSL Profiles 6

7 Use Case 1 After you enable the default profiles, they are bound to all the SSL end points. The default profiles are editable. If your deployment uses most of the default settings and changes only a few parameters, you can edit the default profiles. The changes are immediately reflected across all the end points. The following flowchart explains the steps that you must perform: 1. For information about upgrading the software, see Upgrading the System Software. 2. Enable the default profiles by using the NetScaler command line or GUI. At the command line, type: set ssl parameter -defaultprofile ENABLED If you prefer to use the GUI, navigate to Traffic Management > SSL > Change advanced SSL settings, scroll down, and select Enable Default Profile. If a profile was not bound to an end point before the upgrade, a default profile is bound to the SSL end point. If a profile was bound to an end point before the upgrade, the same profile is bound after the upgrade, and default ciphers are added to the profile. 3. (Optional) Manually change any settings in the default profile. At the command line, type: set ssl profile <name> followed by the parameters to modify. If you prefer to use the GUI, navigate to System > Profiles. In SSL Profiles, select a profile and click Edit. Citrix.com Validated Reference Guide for NetScaler SSL Profiles 7

8 Use Case 2 If your deployment uses specific settings for most of the SSL entities, you can run a script that automatically creates custom profiles for each end point and binds them to the end point. Use the procedure detailed in this section to retain the SSL settings for all the SSL end points in your deployment. After upgrading the software, download and run a migration script to capture the SSL-specific changes. The output of running this script is a batch file. Enable the default profiles and then apply the commands in the batch file. See the appendix for a sample migration of the SSL configuration after upgrade. The following flowchart explains the steps that you must perform: 1. For information about upgrading the software, see Upgrading the System Software. 2. Download and run a script to capture the SSL-specific changes. In addition to other migration activities, the script analyzes the old ns.conf file and moves any special settings (other than the default) from an SSL end point configuration to a custom profile. You must enable the default profiles after the upgrade for the configuration changes to apply. Citrix.com Validated Reference Guide for NetScaler SSL Profiles 8

9 To download the script, log on to On the Downloads tab, select NetScaler ADC, and then select the release (for example, Release 11.0). Within the release, in Firmware, select a build (for example, 64.34). The SSL Default Profile Script is available in Additional Components. Note When running the migration script, you can choose to automatically generate the profile names, or you can prompt the user for the profile names interactively. The migration script checks the following and creates profiles accordingly. End points with the default settings and similar ciphers and cipher group settings: The script creates one profile. End points with the default settings and with different cipher groups or different priorities for the Ciphers/cipher groups: In each case, the script creates a user-defined cipher group, binds it to a profile, and binds each profile to the appropriate end points. End points with the default settings and default ciphers: A default profile is bound to the end point. To run the script, at the command prompt, type:./default_profile_script /nsconfig/ns.conf -b > <output file name> Note You must run this command from the folder in which you store the script. 3. Enable the default profiles by using the NetScaler command line or GUI. At the command line, type: set ssl parameter -defaultprofile ENABLED If you prefer to use the GUI, navigate to Traffic Management > SSL > Change advanced SSL settings, scroll down, and select Enable Default Profile. If a profile was not bound to an end point before the upgrade, a default profile is bound to the SSL end point. If a profile was bound to an end point before the upgrade, the same profile is bound after the upgrade, and default ciphers are added to the profile. Apply the commands in the text file (output of running the migration script) to the configuration. After you apply the commands in the text file, custom profiles are created for end points for which default parameters and ciphers have been changed, and the custom profiles are automatically bound to the end points. Custom SSL Profiles Besides the default SSL profiles, customers can create custom front-end and back-end SSL profiles for specific use cases. There can be scenarios where different applications need different ciphers and SSL parameters. In those cases, customers can create new profiles and bind them to endpoints. There is no upper limit on the number of custom profiles which can be created in a system. Find how to enable SSL Profiles and more details here - Citrix.com Validated Reference Guide for NetScaler SSL Profiles 9

10 SSL Front End Profiles Front-end SSL profiles are related to SSL type virtual servers and Internal services. Front-end profiles are applicable to all the SSL type virtual servers in Load Balancing virtual server, Content Switching virtual server, AAA-TM virtual server and Gateway VPN virtual server categories. Following type of virtual servers support Front-end profiles SSL, SSL_TCP, SIP_SSL, SSL_FIX and SSL_DIAMETER. All Internal services support Front-end profiles. SSL Back End Profiles Back-end profiles are related to SSL type services, service groups and secure monitors. Services and service groups of following type support Back-end profiles SSL, SSL_TCP, SIP_SSL, SSL_FIX, SSL_DIAMETER. Some monitors can be configured to check the health of backend servers over secure connections. SSL profiles can be bound to such monitors to configure the SSL parameters and ciphers. Such monitors are HTTP, HTTP- ECV, HTTP-INLINE, TCP and TCP-ECV. Citrix.com Validated Reference Guide for NetScaler SSL Profiles 10

11 About Citrix Citrix (NASDAQ: CTXS) is a leader in mobile workspaces, providing virtualization, mobility management, networking and cloud services to enable new ways to work better. Citrix solutions power business mobility through secure, personal workspaces that provide people with instant access to apps, desktops, data and communications on any device, over any network and cloud. This year Citrix is celebrating 25 years of innovation, making IT simpler and people more productive. With annual revenue in 2013 of $2.9 billion, Citrix solutions are in use at more than 330,000 organizations and by over 100 million users globally. Learn more at Copyright 2014 Citrix Systems, Inc. All rights reserved. Citrix, NetScaler MPX, NetScaler SDX, NetScaler, Cloud- Bridge and AppFlow are trademarks of Citrix Systems, Inc. and/or one of its subsidiaries, and may be registered in the U.S. and other countries. Other product and company names mentioned herein may be trademarks of their respective companies. Citrix.com Validated Reference Guide for NetScaler SSL Profiles 11