Securing TEMS-to-IZSME communication

IZSME communicates with TEMS in two ways:

Using ZSS, to extract TEMS data
Using Java Sidecar, to extract SDA data

Both of these connections are covered by one rule, securing connection to a specific TEMS using an SPIPE port.

Note: This section must be repeated for each HTEMS that will be using SPIPE and AT-TLS to communicate with IZSME.

Configure the SPIPE port on HTEMS

The SPIPE port should be configured on HTEMS for external communications to make IZSME-TEMS connections with AT-TLS security enabled possible. For background, see Communication between components.

Configure AT-TLS rules for TEMS-IZSME communication

Customize this configuration template and add it to your environment’s TLS policy file. Add these rules to the rules you created previously for securing IZSME internal communications; these TEMS rules will use some of the same configuration items that were created in the internal rules.

TTLSRule IUW_WTEP_AS_HT_CLIENT_<htems_label>
{
   RemoteAddrRef IUW_ADDR_HT_<htems_label>
   RemotePortRangeRef IUW_PORT_HT_<htems_label>
   Userid <server_owner_id>
   Direction Outbound
   Priority 4
   TTLSGroupActionRef gAct1~IUW
   TTLSEnvironmentActionRef eAct1~IUW_AS_CLIENT
   TTLSConnectionActionRef cAct1~IUW_AS_CLIENT_HT_<htems_label>
}
IpAddr IUW_ADDR_HT_<htems_label>
{
   Addr <htems_ip_address>
}
PortRange IUW_PORT_HT_<htems_label>
{
   Port <htems_spipe_port>
}
TTLSConnectionAction cAct1~IUW_AS_CLIENT_HT_<htems_label>
{
   HandshakeRole Client
   TTLSCipherParmsRef cipher-IUW
   TTLSConnectionAdvancedParmsRef cAdv1~IUW_HT_<htems_label>
   CtraceClearText On
   Trace 4
}
TTLSConnectionAdvancedParms cAdv1~IUW_HT_<htems_label>
{
   ResetCipherTimer 0
   SecondaryMap Off
   CertificateLabel <htems_cert_label>
}