Configures the cipher list for outbound SSL interception and TLS connections on the network port pair.
For details about how to configure the advanced SSL settings for SSL interception, see the "Configuring SSL Interception" chapter of the Network Security User Guide.
Syntax
policymgr interface <port-pair-name> ssl-intercept outbound cipher-list {original | fips | cc-ndcpp | fips-and-cc-ndcpp | high-security | compatible | custom}
Parameters
<port-pair-name>
Designation that is configured on the NX appliance interface.
original
Original cipher list that is used for maximum compatibility.
fips
This cipher list is compliant with the Federal Information Processing Standard (FIPS) 140-2.
cc-ndcpp
This cipher list is compliant with Common Criteria Network Device Protection Profile (CC-NDPP).
fips-and-cc-ndcpp
This cipher list is compliant with FIPS 140-2 and CC-NDPP.
high-security
High security option that might support ciphers that are not compliant with FIPS-140-2 and CC-NDPP.
compatible
Improved security that maintains backward compatibility.
custom
A user-created cipher list.
Example
The following example shows how to configure the original Trellix cipher list for outbound SSL interception and TLS connections on the network port pair.
hostname (config) # policymgr interface A ssl-intercept outbound cipher-list original
The following example shows how to configure FIPS 140-2 compliance for outbound SSL interception and TLS connections on the network port pair.
hostname (config) # policymgr interface A ssl-intercept outbound cipher-list fips
The following example shows how to configure CC-NDPP compliance for outbound SSL interception and TLS connections on the network port pair.
hostname (config) # policymgr interface A ssl-intercept outbound cipher-list cc-ndcpp
The following example shows how to configure FIPS 140-2 and CC-NDPP compliance for outbound SSL interception and TLS connections on the network port pair.
hostname (config) # policymgr interface A ssl-intercept outbound cipher-list fips-and-cc-ndcpp
The following example shows how to configure the high security setting for outbound SSL interception and TLS connections on the network port pair.
hostname (config) # policymgr interface A ssl-intercept outbound cipher-list high-security
The following example shows how to configure the compatible setting for outbound SSL interception and TLS connections on the network port pair.
hostname (config) # policymgr interface A ssl-intercept outbound cipher-list compatible
The following example shows how to configure the custom setting for outbound SSL interception and TLS connections on the network port pair.
hostname (config) # policymgr interface A ssl-intercept outbound cipher-list custom
User role
Admin or Operator
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 8.2. The
policymgr interface ssl-intercept outbound cipher-listcommand was changed to thepolicymgr ssl-intercept config outbound cipher-listcommand in Release 8.2.1.