Forum Discussion

Coleburn_340288's avatar
Coleburn_340288
Icon for Nimbostratus rankNimbostratus
Jun 20, 2018

SSL/TLS and certificate settings for iquery port

(edited to correct the naming/usage of the port)

 

Hi!

 

I need to modify the security settings for the iquery port tcp/4353 (TLS versions, ciphers, SSL certificates and certificate chain on bigip running version 12.1.3.4

 

Securing the management gui is trivial since in tmsh the 'list /sys httpd' lists all methods...but how is this done for port 4353? We are not (yet) using external iqueries, so it does not matter if the method includes "session breakage" ;-)

 

security
TMSH
  • Jason_Nance's avatar
    Jason_Nance
    Icon for Nimbostratus rankNimbostratus
    Jun 20, 2018

    TCP:4353 is the iQuery port, not the iControl port. The REST API is accessed via TCP:443 of the management interface (just like logging into the web UI) and uses the device certificate for https (the same as the web UI).

     

  • Coleburn_340288's avatar
    Coleburn_340288
    Icon for Nimbostratus rankNimbostratus
    Jun 20, 2018

    Ok, thanks for the clarification! The question however remains...how can I secure tcp/4353 (TLS versions, Certificate and cert-chain, ciphers, etc.)?

     

  • Jason_Nance's avatar
    Jason_Nance
    Icon for Nimbostratus rankNimbostratus
    Jun 20, 2018

    iQuery also uses your device certificate/key. You manage that in the web UI under "System" -> "Device Certificates" (in 12.x - newer versions of Big IP use "System" -> "Certificate Management" -> "Device Certificate Management").

     

  • Anesh's avatar
    Anesh
    Icon for Cirrostratus rankCirrostratus
    Jun 20, 2018

    TLS versions and ciphers cannot be controlled for iQuery, check this K55736054 , Iquery uses Device certificates to establish trust relationship between devices, check this K16951115