Cisco Catalyst 3750-E User Manual

9-49
Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-08
Chapter 9 Configuring Switch-Based Authentication
Configuring the Switch for Secure Socket Layer HTTP
For more information about these commands, see the “Secure Shell Commands” section in the “Other
Security Features” chapter of the Cisco IOS Security Command Reference, Cisco IOS Release 12.2.
Configuring the Switch for Secure Socket Layer HTTP
This section describes how to configure Secure Socket Layer (SSL) Version 3.0 support for the
HTTP 1.1 server and client. SSL provides server authentication, encryption, and message integrity, as
we
ll as HTTP client authentication, to allow secure HTTP communications.
These sections contain this information:
• Understanding Secure HTTP Servers and Clients, page 9-49
• Configuring Secure HTTP Servers and Clients, page 9-51
• Displaying Secure HTTP Server and Client Status, page 9-55
For configuration examples and complete syntax and usage information for the commands used in this
sec
tion, see the “HTTPS - HTTP Server and Client with SSL 3.0” feature description for Cisco IOS
Release 12.2(15)T.
Understanding Secure HTTP Servers and Clients
On a secure HTTP connection, data to and from an HTTP server is encrypted before being sent over the
Internet. HTTP with SSL encryption provides a secure connection to allow such functions as configuring
a switch from a Web browser. Cisco's implementation of the secure HTTP server and secure HTTP client
uses an implementation of SSL Version 3.0 with application-layer encryption. HTTP over SSL is
abbreviated as HTTPS; the URL of a secure connection begins with https:// instead of http://.
The primary role of the HTTP secure server (the switch) is to listen for HTTPS requests on a designated
por
t (the default HTTPS port is 443) and pass the request to the HTTP 1.1 Web server. The HTTP 1.1
server processes requests and passes responses (pages) back to the HTTP secure server, which, in turn,
responds to the original request.
The primary role of the HTTP secure client (the web browser) is to respond to Cisco IOS application
r
equests for HTTPS User Agent services, perform HTTPS User Agent services for the application, and
pass the response back to the application.
Certificate Authority Trustpoints
Certificate authorities (CAs) manage certificate requests and issue certificates to participating network
devices. These services provide centralized security key and certificate management for the participating
devices. Specific CA servers are referred to as trustpoints.
When a connection attempt is made, the HTTPS server provides a secure connection by issuing a
c
ertified X.509v3 certificate, obtained from a specified CA trustpoint, to the client. The client (usually
a Web browser), in turn, has a public key that allows it to authenticate the certificate.
For secure HTTP connections, we highly recommend that you configure a CA trustpoint. If a CA
tr
ustpoint is not configured for the device running the HTTPS server, the server certifies itself and
generates the needed RSA key pair. Because a self-certified (self-signed) certificate does not provide
adequate security, the connecting client generates a notification that the certificate is self-certified, and
the user has the opportunity to accept or reject the connection. This option is useful for internal network
topologies (such as testing).

Cisco Catalyst 3750-E Specifications

General

Series	Catalyst 3750-E
Switching Capacity	32 Gbps
Stacking Bandwidth	32 Gbps
StackWise Plus	Yes
Layer Support	Layer 3
MAC Address Table Size	12, 000 entries
RAM	256 MB
Flash Memory	64 MB
Memory	256 MB DRAM, 64 MB Flash
Operating Temperature	32 to 113°F (0 to 45°C)
Ports	48 10/100/1000 Ethernet ports
Form Factor	Rack-mountable
Jumbo Frame Support	Yes
Input Voltage	100 to 240 VAC
Storage Temperature	-25 to 70 °C
Relative Humidity	10 to 90% non-condensing