cipher algorithms of ESG loadbalancer

[ymunakata]

I would like you to clear which cipher algorithms ESG loadbalancer with 6.1 supports.

We can select cipher option to negotiate SSL handshake under application profile of ESG loadbalancer. ESG loadbalancer gives me just "default" option. I'm not sure which cipher algorithms ESG supports.

Any input would help me understand ESG loadbalancer.

Thanks in advance,

Yuichiro

[ymunakata]

Some sources says NSX comes form Nicra and vShield. I wonder if we should go over vShield feature. Any input would be help me understand cipher algorithm of NSX ESG.

Thanks in advance,

Yuichiro

[larsonm]

Yes, the acquisition of Nicira in 2012 was integrated with VMware's vShield products to become vCloud Networking and Security (vCNS).  The vCNS components have been superseded by NSX.

ESG uses ciphers included with openssl.  The openssl version depends on the version of NSX.

RC4-MD5, AES128-SHA, AES256-SHA and DES-CBC-SHA are the supported ciphers for the SSL VPN.  It would be logical to think that the same openssl libraries would be used for both, but that is strictly an assumption and may not be accurate.

The "default" value uses the following cipher string:

AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH

If you want to disable SSLv3, use this string:

AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH:!SSLv3:ALL

Details of these strings are referenced in openssl documentation.

The folks who have deeper insights into the specifics on this are likely at VMworld at the moment.

[ymunakata]

Thank you very much for your attention to me. The information you provided would help me understand. I'll go over openssl something to figure out as well.

Thanks again,

Yuichiro

[ymunakata]

Does ESG have any clue to change default cipher suite? ESG is offering just default option for cipher. Any input would help me understand that.

Thanks in advane,

Yuichiro

[ddesmidt]

Larsonm aslready gave an answer.

As explained, the default cipher is: AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH (takes the strongest of AES first. Then the strongest of any cipher but RC4. At last the strongest of RC4. And in any case it will accept a client with no encryption neither authentication).

The syntax used to specify the supported cipher is the one from OpenSSL: https://www.openssl.org/docs/apps/ciphers.html

For instance:

To allow only TLSv1.2, use the cipher “!SSLv3:ALL”

Note: This cipher does not allow TLSv1.0 nor TLSv1.1.

Dimitri

[ymunakata]

Thank you very much for your attention to me again.

Which interface is it available to change the cipher string you provided. I just login to my v-shield to check on what you offered I cannot find a clue to change that.

Thanks in advance,

Yuichiro

[ddesmidt]

You edit your Application Profile, and you enter your cipher list in the field "Cipher".

Dimitri