Configuring Federation-Wide Security Protocols and Cipher Suites for VIPA

You can configure the security protocols and cipher suites that Connection Server instances use for VIPA communications once for the entire pod federation, instead of configuring each pod separately. The settings are stored in Global LDAP and replicate to all pods in the federation.

Connection Server instances in a Cloud Pod Architecture pod federation communicate with each other by using VIPA. If pods in a federation use different security protocol and cipher suite settings, connectivity problems between the pods can occur. Configuring the settings at the federation level provides one consistent set of values for all pods.

Note: These settings apply only to VIPA connections. They do not change the security protocols and cipher suites that are configured for other Connection Server communications. For information about those settings, see Configuring Security Protocols and Cipher Suites on Connection Server for Horizon 8.

How the Federation-Wide Configuration Works

You set the federation-wide values by editing LDAP attributes. You cannot configure these settings in Horizon Console, by using vdmadmin or PowerCLI, or by using the REST API.

• Each pod must opt in to use the federation-wide values. The opt-in setting is specific to each pod and does not replicate to other pods. A pod that has not opted in continues to use its existing local settings, so upgrading does not change the behavior of any pod until you opt it in.
• Each federation-wide attribute is independent. If you do not set an attribute, the pod uses its existing local values for that setting.

Federation-Wide VIPA Security Attributes in LDAP

The federation-wide settings use the following Global LDAP attributes. The attributes for the server role apply when a Connection Server accepts a VIPA connection. The attributes for the client role apply when a Connection Server initiates a VIPA connection.

Attribute Locations

Federation-Wide Acceptance Policies

Federation-Wide Proposal Policies

Federation-Wide Common Policies

Pod Opt-In Attribute

Set the Federation-Wide Attributes

To set the federation-wide security protocols and cipher suites, you use the ADSI Edit utility to edit Global LDAP attributes.

Prerequisites

• Familiarize yourself with the Global LDAP attributes that define the federation-wide settings. See Federation-Wide VIPA Attributes in Global LDAP.

• See the Microsoft TechNet Web site for information on how to use the ADSI Edit utility on your Windows Server operating system version.

• Verify that all pods in the federation run a Connection Server version that supports federation-wide VIPA settings. A pod that does not support the feature does not use the federation-wide values.

Procedure

1. Start the ADSI Edit utility on a Connection Server computer.

2. In the console tree, select Connect to.

3. Connect to the Global LDAP object that holds the federation-wide settings.

4. Select each attribute that you want to set and enter the new value.

   For example: \LIST:TLSv1.3,TLSv1.2

The values replicate to all pods in the federation.

After you change an attribute, new VIPA connections use the updated values. Established VIPA connections are not affected.

Opt a Pod In to the Federation-Wide Configuration

After you set the federation-wide attributes, you must opt in each pod that should use them.

Procedure

1. On a Connection Server computer in the pod, start the ADSI Edit utility.

2. Connect to the pod-local LDAP object that holds the opt-in attribute.

3. Set pae-GlobalSslConfigEnabled to 1 under CN=Common,OU=Global,OU=Properties,<target-local-partition>

4. Repeat these steps for each pod that should use the federation-wide values.

To stop a pod from using the federation-wide values, set pae-GlobalSslConfigEnabled to 0 or remove the attribute. The pod then uses its existing local settings.

Guidelines for Changing Federation-Wide Settings

• Add before you remove - Because values take time to replicate across pods, a one-step replacement of a cipher suite can interrupt connectivity between pods. To change cipher suites, add the new cipher suites first, confirm that all pods have picked them up, and then remove the old cipher suites in a second change.
• Check certificate compatibility - Restricting cipher suites, for example to ECDSA cipher suites only, can prevent VIPA connections to pods whose certificate uses a different key type.
• Use FIPS-approved values in FIPS mode - If your Connection Server instances run in FIPS mode, set the federation-wide values to FIPS-approved cipher suites and protocols.