Sun Logo


Sun Fire B10p SSL Proxy Blade Administration Guide

817-0826-11



Contents

Contents

Declaration of Conformity

Regulatory Compliance Statements

Safety Agency Compliance Statements

Tables

Figures

Preface

1. Product Overview

Hardware and Software Overview

Software Architecture

Command Line and Console Interfaces

Application Software

BSC Firmware

Hardware and Software Requirements

Product Features

Key Features

Supported Protocols

The Role of the SSL Proxy Blade

Topology Fundamentals

The Role of the B10p SSL Proxy Blade

Failover Alternatives

Why VLANs are Required for the Sun Fire B10p SSL Proxy Blade

System Integration

User Access

Command Modes

2. Installing the Blade and Setting Up the System

Installing the Blade

procedure iconsmall spaceTo Install the Blade

LED Displays

Location of Ports

Connecting to the 10/100/1000BASE-T Data Network Ports

Serial Port Pin Numbers

Powering On the SSL Proxy Blade

Powering Off the SSL Proxy Blade

Powering Off With an Orderly Shut Down of the SSL Software

procedure iconsmall spaceForcing the Power Off

procedure iconsmall spacePowering Off an SSL Proxy Blade Without Requiring the Confirmation Prompt

procedure iconsmall spacePowering an SSL Proxy Blade Down to Standby Mode to Save Power

procedure iconsmall spacePowering Off an SSL Proxy Blade Before Removal

Upgrading the Sun Fire B10p SSL Proxy Blade Software

3. Initial Configuration

Initializing the SSL Proxy Blade

procedure iconsmall spaceTo Initialize the SSL Proxy Blade

procedure iconsmall spaceTo Create Keys and Certificates

procedure iconsmall spaceTo Create Services for the Servers

procedure iconsmall spaceTo Verify and Save the Configuration

procedure iconsmall spaceTo Set Up a Telnet Session

4. Setting Up Sun Fire Blades for Load Balancing SSL Traffic

Setting Up for Load Balancing SSL Traffic

Setting Up the Sun Fire B10n Content Load Balancing Blade

procedure iconsmall spaceTo Configure the Network Interface and VLAN

procedure iconsmall spaceTo Configure the SSL Proxy Blade

procedure iconsmall spaceTo Verify the SSL Proxy Blade Configuration on the B10n Content Load Balancing Blade

procedure iconsmall spaceTo Configure a Layer 7 SSL Service on a B10n Content Load Balancing Blade

Setting Up the SSL Proxy Blade

procedure iconsmall spaceTo Access the SSL Proxy Blade Console

procedure iconsmall spaceTo Set Up the SSL Proxy Blade

Setting Up the Router

Setting Up the Sun Fire B1600 Switch

procedure iconsmall spaceTo Get to the Sun Fire B1600 Switch Console

procedure iconsmall spaceTo Set Up the Sun Fire B1600 Switch

procedure iconsmall spaceTo Create VLANs

Setting Up Sun Fire B100s Solaris Server Blades

Setting Up Clients/External Routers

5. Command-Line Interface

Command-Line Interface Basics

User Access

User Access Commands

Concurrent User Commands

Global Commands

Global Command Examples

System State Commands

Commands and Processing States

Fault State

SSL Traffic Commands

TCP Port Numbers

procedure iconsmall spaceTo Display the Current TCP Port Settings

procedure iconsmall spaceTo Set the TCP Port Numbers

procedure iconsmall spaceTo Show HTTPS Forwarding

procedure iconsmall spaceTo Set HTTPS Forwarding

Traffic Port Network Settings

procedure iconsmall spaceTo Display the Current Link Settings

procedure iconsmall spaceTo Set the Link Availability for Ports

Network Interfaces

procedure iconsmall spaceTo Display the Current Interface Settings

procedure iconsmall spaceTo Display the Current Router Information

Configuration Storage

Configuration Management Commands

procedure iconsmall spaceTo Display Differences Between Configurations

procedure iconsmall spaceTo Reset the Default Configuration Settings

procedure iconsmall spaceTo Reset the Configuration

procedure iconsmall spaceTo Save the Configuration

Backups

Import and Export

procedure iconsmall spaceTo Export the Active Configuration Using FTP

procedure iconsmall spaceTo Export the Active Configuration Using TFTP

Import

procedure iconsmall spaceTo Import the Active Configuration Using FTP

procedure iconsmall spaceTo Import the Active Configuration Using TFTP

Keys and Certificates

procedure iconsmall spaceTo Create a Self-Signed Certificate.

procedure iconsmall spaceTo Create a CA-Signed Certificate.

procedure iconsmall spaceTo Import a Certificate From a Server

Certificate Formats

Certificate Management Commands

procedure iconsmall spaceTo Display Information About Keys

procedure iconsmall spaceTo Create a Key

procedure iconsmall spaceTo Delete a Key

procedure iconsmall spaceTo Import a Key Using FTP

procedure iconsmall spaceTo Import a Key Using TFTP

procedure iconsmall spaceTo Import a Key

procedure iconsmall spaceTo Export a Key Using FTP

procedure iconsmall spaceTo Export a Key Using TFTP

procedure iconsmall spaceTo Export a Key

procedure iconsmall spaceTo Create a Certificate

procedure iconsmall spaceTo Import a Certificate Using FTP

procedure iconsmall spaceTo Import a Certificate Using TFTP

procedure iconsmall spaceTo Import a Certificate

procedure iconsmall spaceTo Export a Certificate Using FTP

procedure iconsmall spaceTo Export a Certificate Using TFTP

procedure iconsmall spaceTo Export a Certificate

Setting Default Information for Certificates

procedure iconsmall spaceTo Display the Default Settings for Creating Certificates

procedure iconsmall spaceTo Set the Default Certificate Parameters

Creating a Certificate Signing Request (CSR)

procedure iconsmall spaceTo Create A Certificate Signing Request

procedure iconsmall spaceTo Export a Certificate Signing Request Using FTP

procedure iconsmall spaceTo Export a Certificate Signing Request Using TFTP

procedure iconsmall spaceTo Export a Certificate Signing Request

Services

Service Commands

procedure iconsmall spaceTo Create a Service

procedure iconsmall spaceTo Delete a Service

procedure iconsmall spaceTo Display Current Services

procedure iconsmall spaceTo Display Available Ciphers

DNS Name for a Service

procedure iconsmall spaceTo Create a New Service With a DNS Name (IP=0.0.0.0)

procedure iconsmall spaceTo Display DNS Server Settings

procedure iconsmall spaceTo Set the DNS Server Settings

Diagnostics

procedure iconsmall spaceTo Send a ping Request

procedure iconsmall spaceTo Display the Serial Port Settings

procedure iconsmall spaceTo Set the Number of Lines for a Telnet Session

Statistics

procedure iconsmall spaceTo View the Global Accumulated Statistics

procedure iconsmall spaceTo View the Global Detailed Statistics

procedure iconsmall spaceTo View the Service Statistics

procedure iconsmall spaceTo Reset the Statistics

Event Logging Commands

Log Levels

Info Events

Log Destination

Log Commands

6. Upgrading the Application Software and the BSC Firmware

Software Architecture

Setting Up a TFTP Server

procedure iconsmall spaceTo Set Up a TFTP Server

Upgrading the Application Software From a VLAN-Capable Server

Executing Boot Upload Commands

procedure iconsmall spaceTo Execute Boot Upload Commands Using an FTP Server

procedure iconsmall spaceTo Execute Boot Upload Commands Using a TFTP Server

Verifying the Upgrade

Reverting to a Previous Software Version

Factory Image

Image Commands

show version

reboot

show boot

boot activate

boot revert

boot upload

boot upload-tftp

Upgrading the Application Software From a non-VLAN-Capable Server

procedure iconsmall spaceTo Update the Image From a Non-VLAN-Capable Server

Upgrading the BSC Firmware

A. Security Primer

Encryption

Symmetric Key Encryption

Public Key Encryption

Authentication

Secure Socket Layer

SSL Accelerators

Sessions Per Second

Concurrent Sessions

Bulk Encryption Data Rate

Authenticated Software Upgrades

Export

SSL Proxy Blade Security Features

User Access

Tamper Protection

Configuration Back Up

Supported Ciphers

Key Lengths

B. Application Notes

Web Server Configuration

Redundant Systems

Fail Over Unit Setup

C. Requesting a Certificate

Managing Keys and Certificates

Key Management Features

D. Boot Information

E. SSL Statistics

Persistence of Statistics Counters

Statistics Counters Important to SSL Proxy Blade

Performance

SSL Connection vs. SSL Session

Session ID Reuse

Variable Descriptions

Up Time

Transactions Per Second (TPS)

Concurrent Connections

Throughput

SSL Handshakes

SSL Handshakes With Reused Session IDs

Number of Dropped Reuse ID Requests (Persistent)

F. Troubleshooting

Sanity Check

SSL Proxy Blade Troubleshooting Information Sources

Basic Troubleshooting Principles

Most Common Problems for the SSL Proxy Blade

G. Alphabetical Command Reference

A

B

C

D

E

H

I

L

P

R

S

T

W

Glossary