EMC® VNX® Series Security Configuration Guide for VNX

Supported TLS cipher suites

A cipher suite defines a set of technologies to secure your TLS communications:

• Key exchange algorithm (how the secret key used to encrypt the data is communicated from the client to the server). Examples: RSA key or Diffie-Hellman (DH)
• Authentication method (how hosts can authenticate the identity of remote hosts). Examples: RSA certificate, DSS certificate, or no authentication
• Encryption cipher (how to encrypt data). Examples: AES (256 or 128 bits) or 3DES (168 bits)
• Hash algorithm (ensuring data by providing a way to determine if data has been modified). Examples: SHA-2 or SHA-1

The supported cipher suites combine all these items. Default/Supported TLS cipher suites on VNX2 Control Station lists the cipher suites supported by VNX2 for the Control Station. Default/Supported TLS cipher suites on VNX2 Storage Processor lists the cipher suites supported by VNX2 for the Storage Processor. Default/Supported TLS cipher suites on VNX2 Data Mover lists the default/supported cipher suites used by VNX2 for the Data Mover. Default/Supported TLS cipher suites on VNX2 related to Replication lists the cipher suites supported by VNX2 for Replication. Default/Supported TLS cipher suites on VNX1 Control Station lists the cipher suites supported by VNX1 for the Control Station. Default/Supported TLS cipher suites on VNX1 Storage Processor lists the cipher suites supported by VNX1 for the Storage Processor. Default/Supported TLS cipher suites on VNX1 Data Mover lists the default/supported cipher suites used by VNX1 for the Data Mover. Default/Supported TLS cipher suites on VNX1 related to Replication lists the cipher suites supported by VNX1 for Replication.

The following lists give the OpenSSL names of the TLS cipher suites for the different VNX components and their associated ports.

The following restriction applies:

• Some cipher suites will not be accepted by VNX for file because of certificate size (if the certificate presented by the Data Mover has a 2048-bit key, ciphers with a smaller key will be rejected).

If required, the Data Mover cipher parameter can be changed from the default setting either through Unisphere or through VNX CLI for File commands, server_ftp and server_http. For more information about setting the Data Mover cipher parameter, refer to the Unisphere online help or the VNX Command Line Interface Reference for File.