To enable the HTTP accelerator: at the Accelerator Optimization pane of the Enabled Features window, check the HTTP Accelerator check box.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Acceleration > HTTP/HTTPS Settings.

Configure the metadata cache settings. At the Metadata Cache Settings pane:

1. To enable the Cisco WAE to cache each HTTP header (metadata) information, check the Enable HTTP metadatacache caching check box. The default setting is checked.

   This check box must be checked to enable any of the other settings in the Metadata Cache Settings pane. If this box is not checked, no header caching is done.

   For more information, see HTTP Metadata Caching.

2. To enable the Cisco WAE to cache HTTPS header (metadata) information (HTTP as payload in SSL traffic), check the Enable HTTPS metadatacache caching check box. The default setting is checked.

   For more information, see HTTP Metadata Caching.

3. In the Maximum age of a cache entry field, enter the maximum number of seconds to retain HTTP header information in the cache. The default is 86,400 seconds (24 hours). Valid time periods range from 5–2,592,000 seconds (30 days).

4. In the Minimum age of a cache entry field, enter the minimum number of seconds for which to retain HTTP header information in the cache. The default is 60 seconds. Valid time periods range from 5 to 86,400 seconds (24 hours).

5. To enable the Cisco WAE to cache and to locally serve HTTP 301 messages, check the Enable local HTTP 301 redirect messages check box. The default setting is checked.

6. To enable the Cisco WAE to cache and locally serve HTTP 401 messages, check the Enable local HTTP 401 Authentication-required messages check box. The default setting is checked.

7. To enable the Cisco WAE to cache HTTP 200 and HTTP 304 messages and locally serve HTTP 304 messages, check the Enable local HTTP 304 Not-Modified messages check box. The default setting is checked.

8. To configure specific file extensions to which metadata caching is to be applied, enter the file extensions in the File extension filters field at the far right of the window. Separate multiple extensions with a comma, for example, jpeg, gif, png, and do not include the dot at the beginning of the file extension.

   By default, no file extension filters are defined and therefore, metadata caching applies to all file types.

To allow the Cisco WAAS Edge WAE to prefetch data, at the Sharepoint Settings pane, check the Enable Pre-fetch Optimization check box. The default for this setting is unchecked.

Check the Suppress server compression for HTTP and HTTPS check box to configure the WAE to suppress server compression between the client and the server. The default setting is checked.

To configure the Cisco WAE to suppress server compression between the client and the server, at the Server Compression Settings pane, check the Suppress server compression for HTTP and HTTPS check box. The default setting is checked.

To send DRE hints to the DRE module for improved DRE performance, at the DRE Hints Settings pane, check the Enable DRE Hints for HTTP and HTTPS check box. The DRE hint feature is enabled by default.

Click Submit.

Enable global configuration for all the HTTP accelerator features that you want to use.

Create an IP access list to use for a subnet of traffic:

WAE(config)# ip access-list extended md_acl
WAE(config-ext-nacl)# permit ip 1.1.1.0 0.0.0.255 any
WAE(config-ext-nacl)# permit ip 2.2.2.0 0.0.0.255 3.3.3.0 0.0.0.255
WAE(config-ext-nacl)# exit

Associate the ACL with a specific HTTP accelerator feature. For more information on associating an ACL with an HTTP accelerator feature, see the accelerator http global configuration command in the Cisco Wide Area Application Services Command Reference:

WAE(config)# accelerator http metadatacache access-list md_acl

To enable the MAPI accelerator, choose Configure > Acceleration > Enabled Features window.

1. At the Accelerator Optimization pane, check the MAPI Accelerator check box.

2. Click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Acceleration > MAPI Settings.

The MAPI Acceleration Settings window appears.

In the Reserved Pool Size Maximum Percent field, enter the maximum percent of connections in order to restrict the maximum number of connections reserved for MAPI optimization during TFO overload.

Click Submit.

Configure DNS settings.

Configure NTP settings to synchronize the time with the Active Directory.

Verify if Cisco WAE devices are registered and are online with the Cisco WAAS Central Manager.

Configure the SSL Peering Service.

Verify that WAN Secure mode is enabled.

(Optional on data center WAEs if only user accounts are used for domain identity configuration in Step 7.)

Configure domain identities. This is not required for branch WAEs.

1. Configure the machine account identity.

   A machine account for the core device is automatically created during the join process in the Windows Domain Server authentication procedure in Step 6. If you are using a machine account, a machine account identity must be configured for this account.

   Each device supports only one machine account identity.

   For more information, see Configuring a Machine Account Identity.

2. Create and configure optional user accounts.

   You can utilize up to four optional user accounts for additional security. Multiple user accounts provide greater security than having all of the core devices using a single user account. You must configure a user account identity for each user account, whether you are utilizing an existing user account or creating a new one.

   For more information, see Creating and Configuring a User Account.

Enable Windows Domain Encrypted Service. (This is enabled by default.)

1. From the the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

2. From the menu, choose Configure > Security > Windows Domain > Encrypted Services.

   The Encrypted Services window appears.

3. Check the Enable Encrypted Service check box.

4. To save your changes, click Submit.

Enable Encrypted MAPI Traffic Optimization.

1. Choose Configure > Acceleration > Enabled Features.

   The Enabled Features window appears.

2. In the Enabled Features window, check the Encrypted MAPI Traffic Optimization check box.

3. In the Enabled Features window, check the MAPI Accelerator check box.

   Note	To enable Encypted MAPI, you must also check the MAPI Accelerator check box. (Encrypted MAPI traffic optimization is enabled by default.)

4. Click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

From the menu, choose Configure > Security > Windows Domain > Encrypted Services.

Click the Add Domain Identity button.

The Domain Identity dialog box appears.

Note	Every Cisco WAAS device that has to be accelerated must have a domain identity.

1. In the Domain Identity dialog box, from the Account Type drop-down list, choose Machine Account.

   Note	Windows domain join must be completed before creating the machine account domain identity. For more information, see Configuring Windows Domain Server Settings on a Cisco WAAS Device in the chapter "Configuring Administrative Login Authentication, Authorization, and Accounting."

2. Enter the identity name in the Identity Name field. Only alphanumeric characters are allowed. Space, ?, and | are not allowed. The length is not to exceed 32 characters.

   Note	The domain identity must have sufficient privileges in the Windows Domain Active Directory to replicate the desired domain information to optimize encrypted traffic. To configure privileges, see Configuring Microsoft Active Directory.

Click the Add Match Domain button to add the child domains of the domain (with which the device is registered) for which the Domain Identity should optimize the encrypted traffic. You can add up to 32 child domains. If you do not want the Domain Identity to optimize the traffic for any of the child domains, you can delete the selected match domain items.

Click OK.

The domain identity appears in the Encrypted Services Domain Identities list.

To configure and verify Encrypted Services Domain Identities from the CLI, run the windows-domain encrypted-service global configuration command and the show windows-domain encrypted-service EXEC command.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

From the menu, choose Configure > Security > Windows Domain > Encrypted Services.

The Encrypted Services window appears.

To add a user account domain identity, in the Encrypted Service Domain Identity(s) table listing area, click Add Domain Identity.

The Domain Identity window appears.

1. From the Account Type drop-down list, choose User Account.

2. In the Identity Name field, enter the identity name. Use only alphanumeric characters, up to a maximum of 32 characters.

3. Enter username and password.

4. Enter the domain name.

5. Enter the Kerberos realm.

6. To add the child domains of the domain (with which the device is registered) for which the Domain Identity should optimize the encrypted traffic, click the Add Match Domain button.

   You can add up to 32 child domains. If you do not want the Domain Identity to optimize the traffic for any of the child domains, you can delete the selected match domain items.

   Note	The domain identity must have sufficient privileges in the Windows Domain Active Directory to replicate the desired domain information to optimize encrypted traffic. For more information, see Configuring Microsoft Active Directory.

Click OK.

To configure and verify Encrypted Services Domain Identities from the CLI, run the windows-domain encrypted-service global configuration command and the show windows-domain encrypted-service EXEC command.

To grant Cisco WAAS permission to accelerate Microsoft Exchange-encrypted email sessions: Using an account with Domain Administrator privileges, launch the Active Directory Users and Computers application.

Create a new group.

1. Right-click the Unit to contain the new group and choose New > Group.

   

2. Enter a name in the Group name field and select the following attributes:

   • Group scope: Universal

   • Group type: Security

3. Click OK.

Configure the permissions required by Cisco WAAS.

1. At the menu bar of the Active Directory Users and Computers window, choose View > Advanced Features.

2. Right-click the root of the domain and choose Properties.

3. Click the Security tab.

   

4. In the Group or User Names section, click Add.

5. In the Enter the object names to select field, enter the name of the new group .

6. To add the new group to the list, click OK.

7. Check the check box adjacent to the new group in the Group or User names list and set the following permissions to Allow:

   • Replicating Directory Changes

   • Replicating Directory Changes All

8. Click OK.

Add an account to the group.

1. Right-click on the account you want to add and select the Member Of tab.

2. Click Add.

3. Choose the new group you created and click OK.

Ensure that the SSL, HTTP and MAPI accelerators are enabled. If you have enabled SSL Interposer (SSL Accelerator V2) on both branch and data center devices, MAPI over RPC HTTPS will use Smart-SSL and not SSL Accelerator V1.

Configure SSL acceleration. For more information, see Configuring SSL Acceleration. If you enable SSL Interposer (SSL Accelerator V2) on both branch and data center devices, MAPI over RPC HTTPS will use Smart-SSL and not SSL Accelerator V1.

When you configure SSL acceleration, be sure to enable protocol chaining, by checking the Enable protocol chaining check box in the SSL Accelerated Services window.

Configure a Microsoft Windows domain identity on the core device, for Encrypted MAPI connections.

Verify that encryption is enabled in the MAPI accelerator. For more information, see Configuring Encrypted MAPI Settings.

To enable the SMB accelerator, check the SMB Accelerator check box in the Enabled Features window.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Acceleration > SMB Settings.

From the Highest Dialect Optimized drop-down list, choose the highest dialect to optimize. The available options are:

From the Highest Dialect Optimized Exceed Action drop-down list, choose the action for the dialects that are higher than the one chosen as the highest dialect to optimize:

In the Bypass File Name Pattern field, enter the patterns for the file names that you want the SMB accelerator to bypass optimization for. The files whose names match the specified expressions are not optimized.

To enable disk caching for SMB traffic, check the SMB Object Cache check box.

To enable optimization of signed SMB v2 and v3 traffic, check the Signing Optimization check box. This check box is checked by default.

Click the SMBV1 Optimization Settings tab to perform the following tasks:

Click the SMBV2 Optimization Settings tab to perform the following tasks:

Click the SMBV3 Optimization Settings tab to perform the following tasks:

To save the changes, click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Acceleration > ICA Settings.

The ICA Acceleration Configuration window appears.

Check the Enable Multi Stream ICA check box to allow the client and server up to three additional TCP connections that optimize multistream ICA traffic.

From the WAN Secure Mode drop-down list, choose the mode. The options are:

To configure DSCP values for MSI priority levels: In the DSCP Settings (QoS) under ICA Streams section, check the Enable DSCP Tagging check box. These values override the defaults.

Click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Next choose Configure > Acceleration > Optimization Class-Map.

Edit the class-map named Citrix and add the required port number using the Add Match Condition option.

Select the branch device and make the necessary changes for the port number.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Security > SSL > Global Settings.

To configure a device to use SSL settings from a particular device group: From the Select a Device Group drop-down list in the SSL global settings toolbar, choose a device group.

From the SSL version drop-down list, choose the type of SSL protocol to use.

(Optional) Set the Online Certificate Status Protocol (OCSP) parameters for certificate revocation:

From the Cipher List drop-down list, choose a list of cipher suites to be used for SSL acceleration. For more information, see Working with Cipher Lists.

Choose a certificate/key pair method.

Click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Security > SSL > Global Settings.

To generate a self-signed certificate and private key, at the Certificate and private key pane, click Generate self-signed certificate and private key.

1. To export this certificate/key in the Cisco WAAS Central Manager and device CLI later, check the Mark private key as exportable check box.

2. Fill in the certificate and private key fields.

3. Consider the following guidelines for the Key Size drop-down list:

   Table 8. Key Size Field Guidelines

   Cisco WAAS Version	Key Size Field Guideline
   Cisco WAAS Version 6.1.x and earlier	The Key Size drop-down list values are 512, 768, 1024, 1536, and 2048 A self-signed certificate with an RSA modulus size of 512 is not compatible with Mozilla FireFox Version 39 and later, or with Google Chrome Version 48 and later. A self-signed certificate with an RSA modulus size of 512 is compatible with Internet Explorer 8 and later. If you have previously configured the RSA modulus size as 512: to access the Cisco WAAS Central Manager Mozilla FireFox Version 39 and later, or with Google Chrome Version 48 and later, you must regenerate the self-signed certificate with an RSA modulus size of 2048, and then upgrade to the specified version of Mozilla FireFox or Google Chrome.
   Cisco WAAS Version 6.2.x and later	The Key Size drop-down list values are 768, 1024, 1536, and 2048.

To import an existing certificate or certificate chain and, optionally, private key:

1. Check the Mark private key as exportable check box to export this certificate/key in the WAAS Central Manager and device CLI later.

2. To import existing certificate or certificate chain and private key, perform one of the following tasks:

   • Upload the certificate and key in PKCS#12 format (also as known Microsoft PFX format)

   • Upload the certificate and private key in PEM format

   • Paste the certificate and private key PEM content

   Consider the following operating guidelines for importing an existing certificate or certificate chain and private key:

   • If the certificate and private key are already configured, you can update only the certificate. In this case, the Cisco WAAS Central Manager constructs the certificate and private key pair using the imported certificate and current private key. This functionality can be used to update an existing self-signed certificate to one signed by the CA, or to update an expiring certificate.

   • The Cisco WAAS Central Manager allows importing a certificate chain consisting of an end certificate that must be specified first, a chain of intermediate CA certificates that sign the end certificate or intermediate CA certificate, and end with a root CA.

   • The Cisco WAAS Central Manager validates the chain and rejects it if the validity date of the CA certificate is expired, or the signing order of certificates in the chain is not consequent.

3. At the Upload field, use the Browse button to browse to the file and then select it.

4. In the Passphrase to decrypt private key field, enter a passphrase to decrypt the private key. If the private key is not encrypted, leave this field blank.

To export a configured certificate and private key, in the Export Certificate and Key window:

1. In the Encryption pass-phrase field, enter the encryption pass-phrase.

2. Export current certificate and private key in either PKCS#12 or PEM formats. In the case of PEM format, the both certificate and private key are included in single PEM file.

   The Cisco WAAS Central Manager will not allow the export of certificate and private key if the certificate and key were marked as nonexportable when they were generated or imported.

To generate a certificate-signing request from a current certificate and private key, in the Generate Certificate-Signing Request window, follow these steps:

To update the current certificate with one signed by the Certificate Authority, follow these steps:

1. At the Certificate and private key pane, click Export certificate and key.

   The Export certificate and key window appears.

   

2. In the Encryption pass-phrase field, enter the encryption passphrase.

3. Choose an export format for the certificate:

   • Export certificate and private key in PKCS 12 format

   • Export certificate and private key in PEM format

     For PEM format, both the certificate and private key are included in a single PEM file

     Note	The Cisco WAAS Central Manager does not allow the export of certificate and private key if the certificate and key were marked as nonexportable when they were generated or imported.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Security > SSL > Cipher Lists.

To add a new cipher list, click Create.

In the Cipher List Name field, type a name for your cipher list.

To add cipher suites to your cipher list, click Add Cipher.

From the Ciphers drop-down list, choose the cipher suite that you want to add.

From the Priority drop-down list, choose the priority for the selected cipher suite.

To include the selected cipher suite on your cipher list, click Add. To leave the list as it is, click Cancel.

To add more cipher suites to your list as desired, repeat Step 5 through Step 8 .

(Optional) To change the priority of a cipher suite, check the cipher suite check box and then use the up or down arrow buttons located below the cipher list to prioritize.

(Optional) To remove a cipher suite from the list, check the cipher suite’s box and then click Delete.

After you have completed configuring the cipher list, click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Security > SSL > Certificate Authorities.

To add one of the preloaded CA certificates that is included with Cisco WAAS:

1. Click Well-known CAs.

2. Choose the pre-existing CA certificate you want to add and click Import.

   The selected CA certificate is added to the list on the SSL CA Certificate List display.

To add your own CA certificate:

1. Click Create.

   The Creating New CA Certificate window appears.

   

   For a Cisco WAAS Express device, click Add CA to add your own CA certificate. Enter the name and the URL, and then click Get CA Certificate. After this, proceed to Step 6.

2. In the Certificate Name field, type a name for the certificate.

3. (Optional) In the Description field, type a description of the CA certificate.

4. From the Revocation check drop-down list, choose Disable to disable OCSP revocation of certificates signed by this CA. Check the Ignore OCSP failures check box to mark revocation check successful if the OCSP revocation check failed.

5. To add the certificate information, choose one of the following:

   • Upload PEM File

     If you are uploading a file, it must be in a PEM format. Browse to the file that you want to use and click Upload.

   • Paste PEM-encoded Certificate

     If you are pasting the CA certificate information, paste the text of the PEM format certificate into the Paste PEM-encoded certificate field.

   • Get CA Certificate using SCEP

     This option automatically configures the certificate authority using Simple Certificate Enrollment Protocol (SCEP). If you are using the automated certificate enrollment procedure, enter the CA URL and click Get Certificate. The contents of the certificate are displayed in text and PEM formats.

     To complete the automated certificate enrollment procedure, configure the SSL auto enrollment settings in Configuring SSL Auto Enrollment.

6. Click Submit to save your changes.

(Optional) To remove a CA from the list, select it and then click the Delete icon located in the toolbar.

After you have completed configuring the CA certificate list, click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Security > SSL > Auto Enrollment.

Configure the following CA settings:

Configure the following Certificate Signing Request settings:

From the Key Size drop-down list, choose the key size. Valid values are 512, 768, 1024, 1536, or 2048.

Check the Enable Enroll box.

Click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > CM > Configure > Security > SSL Admin Service.

Select the PKI operation

1. To upload or paste an existing certificate and key pair, click Import Existing Certificate Key.

2. To export the current certificate and key pair, click Export Certificate Key.

   The file that you import or export must be in either a PKCS12 format or a Privacy Enhanced Mail (PEM) format.

3. To configure the Cisco WAAS Central Manager and Cisco WAAS device to use a self-signed certificate and key pair for SSL, click Generate Self-signed Certificate Key.

   Operating Considerations for Key Size field:

   Cisco WAAS Version 6.1.x and earlier

   • The Key Size drop-down list values are 512, 768, 1024, 1536, and 2048.

   • A self-signed certificate with an RSA modulus size of 512 is not compatible with Mozilla FireFox Version 39 and later, or with Google Chrome Version 48 and later.

   • A self-signed certificate with an RSA modulus size of 512 is compatible with Internet Explorer 8 and later.

   • If you have previously configured the RSA modulus size as 512: to access the Cisco WAAS Central Manager Mozilla FireFox Version 39 and later, or with Google Chrome Version 48 and later, you must regenerate the self-signed certificate with an RSA modulus size of 2048, and then upgrade to the specified version of Mozilla FireFox or Google Chrome.

   Cisco WAAS Version 6.2.x and later

   • The Key Size drop-down list values are 768, 1024, 1536, and 2048.

   • The key size 512 is not used with WAAS Version 6.2.x and later.

Click Submit to register the certificate.

To register the certificate, click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > device-name.

Choose Configure > Security > Management Service.

The Management Services window appears.

From the SSL version drop-down list, choose the type of SSL protocol to use:

At the Cipher List pane, choose a list of cipher suites to be used for SSL acceleration. For more information, see Working with Cipher Lists for additional information.

From the Cisco WAAS Central Manager menu, choose Devices > device-name.

Choose Configure > Security > Peering Service.

The Peering Service window appears.

From the SSL Version drop-down list, choose the type of SSL protocol to use:

To enable verification of peer certificates, check the Enable Certificate Verification check box.

To disable OCSP certificate revocation checking, check the Disable revocation check for this service check box.

At the Cipher List pane, choose a list of cipher suites to be used for SSL acceleration between the WAE device peers.

Click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Acceleration > SSL Accelerated Services.

To delete an accelerated service, select the service and click Delete.

To define a new accelerated service, click Create. A maximum of 512 accelerated services are allowed.

At the SSL Accelerated Service pane:

1. In the Service Name field, enter a name for the service.

2. To enable this accelerated service, check the In service check box.

3. To enable client version rollback check, check the Client version rollback check check box.

   Enabling the client version rollback check does not allow connections with an incorrect client version to be optimized.

4. To match subject alternative names, check the Match Server Name Indication check box.

   For more information, see Configuring SSL Acceleration for SaaS Applications.

5. To enable protocol chaining, check the Enable protocol chaining check box.

   Enabling protocol chaining allows other protocols to be optimized over SSL.

6. From the Application drop-down list, choose the SAAS application that needs to be optimized.

   This field is visible only on the devices that are running Cisco WAAS Version 6.4.3 or later.

7. Check the Enable DSCP Remarking and enter values in the DSCP LAN and DSCP WAN fields. The available values are 0 to 63.

   • The Enable DSCP Remarking check box is unchecked (disabled) by default.

   • For this configuration to be applicable to all devices that are part of a device group, all devices in the device group must be running Cisco WAAS Version 6.4.3 or later. If any of the devices has a version earlier than Cisco WAAS Version 6.4.3, the configurations will not apply to that device.

8. To configure the accelerated service to use multiple IP addresses, check the Secondary checkbox.

   This is applicable only for Cisco WAAS devices running Cisco WAAS Version 6.4.3 or later.

   • (Optional) In the Description field, enter a description.

   Checking the Secondary check box ensures the following actions for this accelerated service:

   • This accelerated service is distinguished from the primary accelerated service using multiple IP addresses.

   • This accelerated service is not pushed down to other devices that are part of the device group that are running a Cisco WAAS version that is earlier than Cisco WAAS Version 6.4.3.

   • This accelerated service is removed during a downgrade.

At the Server addresses pane:

1. From the Server drop-down list, choose IP Address, Hostname, or Domain as the SSL service endpoint type.

2. In the associated Server field, enter one of the following:

   • Server IP address (or proxy IP address) of the accelerated server, up to a maximum of 32 IP addresses.To specify any server IP address, use the keyword Any. Server IP address keyword Any is supported for Cisco WAAS Software Version 4.2.x and later.

   • Hostname of the accelerated server, up to a maximum of 32 hostnames. Hostname server address type is supported for Cisco WAAS Version 4.2.x and later.

   • Domain of the accelerated server, up to a maximum of 32 domains. Domain server address type is supported for Cisco WAAS Version 4.2.x and later.

3. At the Server Port field, enter the port associated with the service to be accelerated.

Click Add to add each address. If you specify a server hostname, the Cisco WAAS Central Manager resolves the hostname to the IP address and adds it to the Server IP/Ports table.

To remove an IP address from the list, click Delete.

Choose a certificate and key pair method.

• At the Server Certificate and private key pane:

  • To configure the Cisco WAAS devices to use a self-signed certificate and key pair for SSL, click Generate self-signed certificate key.

  • To upload or paste an existing certificate and key pair, click Import Existing Certificate Key.

    For SaaS applications, the certificate must have the Subject Alternative Name (SAN) information.

  • To export the current certificate and key pair, click Export Certificate Key.

  • To renew or replace the existing certificate and key pair, click Generate Certificate Signing Request. The certificate signing request is used by the CA to generate a new certificate.

    The file to be imported or exported must be in either PKCS12 format or PEM format.

  • To use the client configured certificate, click Import existing client certificate and optionally private key.

(Optional) To change the service certificate or private key for an existing SSL-accelerated service, follow these guidelines:

1. At the SSL Accelerated Service pane, uncheck the In service check box.

2. To disable the service, click Submit, and then wait five minutes.

3. Check the In service check box.

4. To re-enable the service, click Submit.

5. Alternatively, in the Cisco WAE CLI:

   • Run the no inservice SSL-accelerated service configuration command.

   • Wait a few seconds.

   • Run the inservice SSL-accelerated service configuration command.

   To change the service certificate or private key for multiple SSL-accelerated services, restart all the accelerated services by disabling and then re-enabling the SSL accelerator.

   For service certificate and private key configuration steps, see Generating, Importing, or Exporting a Service Certificate and Private Key.

To configure SSL parameters for the service, click the Advanced Settings tab.

The SSL Accelerated Services Configuration window, Advanced tab appears.

1. (Optional) At the SSL Settings pane, from the SSL version drop-down list, choose the type of SSL protocol to use:

   • To use the SSL protocol configured in Global SSL Settings window, choose Inherited. For more information on configuring global SSL settings, see Configuring SSL Global Settings.

   • To use the SSL Version 3 protocol, choose SSL3.

   • To use the Transport Layer Security Version 1 protocol (TLS Version 1), choose TLS1.

   • To use both the SSL Version 3 and TLS 1 protocols, choose All.

2. (Optional) At the SSL Settings pane, from the Cipher List drop-down list, choose a list of cipher suites to be used for SSL acceleration between the Cisco WAE device peers, or choose Inherited to use the cipher list configured in SSL global settings. For more information, see Working with Cipher Lists.

3. (Optional) To set the OCSP parameters for certificate revocation, follow these steps:

   • To enable the verification of client certificate check, check the Verify client certificate check box.

   • To disable OCSP client certificate revocation checking, check the Disable revocation check for this service check box.

   • To enable verification of server certificate check, check the Verify server certificate check box.

   • To disable OCSP server certificate revocation checking, check the Disable revocation check for this service check box.

     If the server and client devices are using self-signed certificates and certificate verification is enabled, Cisco WAAS devices will not be able to accelerate SSL traffic.

4. After you have completed the configuration of the SSL accelerated service, click Submit.

From the Cisco WAAS Central Manager menu, choose Devices > device-name or Device Groups > device-group-name.

Choose Configure > Acceleration > SSL Accelerated Services.

In the Name column for the specified service, click Edit SSL Accelerated Service.

Choose a certificate and key pair method to either regenerate a self-signed certificate and private key or to import an updated certificate and/or key.

1. Enter the required details.

2. Depending on the chosen method, click Generate or Import.

3. Click Submit.

   • When you update a certificate for an SSL Accelerated Service and want it to be used by it, it is important to stop and start the configured SSL Accelerated Service.

     This step is required because the existing certificate and key are stored in memory on the accelerators. Updating the certificate/key via the steps described above is insufficient because it does not update the certificate/key in memory.

   • To ensure the updated certificate for the SSL Accelerated Service is used, make sure to follow the steps below as well.

In the Name column for the specified service, click Edit SSL Accelerated Service button.

Remove the check mark for In service, and then click Submit.

Click the Edit SSL Accelerated Service button in the Name column for the service in question for one last time.

Enable the check mark for In service.

Click Submit.

To create an SSL-accelerated service for a SaaS application, use Step 1 through Step 8 outlined in Using SSL Accelerated Services.

To match subject alternative names, check the Match Server Name Indication check box, or run the match sni command on the core Cisco WAAS device.

To specify the server IP address of the accelerated server, use the keyword Any.

Direct all SSL traffic for SaaS applications to port 443.

To upload or paste a certificate and key pair, click Import Existing Certificate Key.

To complete the configuration of the SSL-accelerated service for the SaaS application, click Submit.

Identify the relevant servers to be added.

Run the sh crypto ssl services accelerated-service service-name command to see additional details regarding the count and last seen information of the server name.

To enable SNI debugs, to view additional information regarding IP address and hostnames, run the debug accelerator ssl sni command.

To create a new Certificate Signing Request (CSR) with the relevant server domain names of the SaaS applications in the subject alternative names extension of the certificate, log in to the Microsoft Management Console (MMC), or OpenSSL, or other available customer tool.

Certificate:
     Data:
          Version: 3 (0x2)
          Serial Number:
              ec:aa:9b:10:fa:9d:09:95
          Signature Algorithm: sha1WithRSAEncryption
          Issuer: C=US, ST=California, L=San Jose, O=Cisco
          Systems Inc, OU=WAAS,
          CN=Cisco_WAAS_CA/emailAddress=support@cisco.com
          Validity
              Not Before: Jul 31 06:49:56 2013 GMT
              Not After : Aug 30 06:49:56 2013 GMT
          Subject: C=US, ST=California, L=San Jose, O=Cisco
                  Systems Inc, OU=WAAS,
                  CN=Office365/emailAddress=support@cisco.com
          Subject Public Key Info:
              Public Key Algorithm: rsaEncryption
              Public-Key: (1024 bit)
              Modulus:
                  00:c6:85:0d:f9:df:4e:4f:c4:53:d5:3e:0f:c4:cb:
                  53:42:34:34:7d:92:7f:ea:c1:75:0b:21:3f:5f:a1:
                  be:34:f1:40:c3:32:52:a1:05:79:26:7b:a3:29:c5:
                  5e:9f:3f:92:6b:d1:b2:fd:bc:c9:2b:8b:e2:9f:1a:
                  91:83:9b:c8:7f:3f:d9:56:92:75:be:b6:ed:39:39:
                  2f:1a:2f:ba:39:1b:06:76:0a:17:b5:f0:ec:dd:4c:
                  fa:94:be:ea:7c:e0:4e:51:b4:d2:75:4d:8b:d9:6e:
                  de:34:10:c7:c5:e8:97:5f:f2:7f:97:1e:9a:e0:e2:
                  fc:b4:58:11:45:82:19:14:11
Exponent: 65537 (0x10001)
     X509v3 extensions:
         X509v3 Basic Constraints:
                CA:FALSE
         X509v3 Key Usage:
         Digital Signature, Non Repudiation, Key Encipherment
         X509v3 Subject Alternative Name:
            DNS:*.office365.com, DNS:outlook.com, DNS:*.aadcdn.microsoftonline-p.com,
DNS:*.aspnetcdn.com, DNS:*.client.hip.live.com, DNS:*.hip.live.com,
DNS:*.linkedinlabs.com, DNS:*.live.com, DNS:*.microsoft.com, DNS:*.microsoftonline-p.com,
DNS:*.microsoftonline-p.net, DNS:*.microsoftonline.com, DNS:*.microsoftonlineimages.com,
DNS:*.microsoftonlinesupport.net, DNS:*.msecnd.net, DNS:*.msocdn.com, DNS:*.office.net,
DNS:*.office365.com, DNS:*.officeapps.live.com, DNS:*.officecdn.microsoft.com,
DNS:*.onmicrosoft.com, DNS:*.outlook.com, DNS:*.res.outlook.com, DNS:*.sharepoint.com,
DNS:*.sharepointonline.com, DNS:*.telemetry.microsoft.com,
DNS:*.testexchangeconnectivity.com, DNS:*.vo.msecnd.net, DNS:*.webtrends.com

Signature Algorithm: sha1WithRSAEncryption
        46:db:34:7f:c0:8e:13:81:67:0b:3c:8d:15:3a:ee:1f:c7:cf:
        d1:6b:de:00:2a:35:9b:13:d6:bf:79:43:ce:31:c6:f9:de:f7:
        20:1f:0e:86:9e:d4:91:01:57:a2:7b:fe:91:00:de:cf:58:90:
        85:97:49:b3:11:4c:e9:05:d0:a1:a7:73:7e:50:64:8f:80:f4:
        ec:fa:a7:bb:7a:c2:df:5e:c5:e3:a8:52:c4:31:4e:8e:53:36:
        59:e9:0f:27:82:71:4e:3b:79:a4:c9:4f:18:7e:06:7a:0c:34:
        0a:cf:3c:3e:73:73:5a:52:7d:03:a0:75:50:5a:d4:a5:8b:a9:
        ea:96

Submit the certificate to the Enterpise CA.

Import the signed certificate from the Enterprise CA to the Trusted Root Certification Authorities store.

To disable the accelerated service, uncheck the In service checkbox and click Submit.

Upload the new certificate and re-enable the service.

DNS:*.service-now.com, DNS:service-now.com, DNS:*.servicenow.com, DNS:servicenow.com,
DNS:*.cisco.com, DNS:cisco.com, DNS:*.cloudapps.cisco.com, DNS:cisco.sc.omtrdc.net,
DNS:tags.tiqcdn.com, DNS:ssl.gstatic.com, DNS:dpm.demdex.net, DNS:beacons.gcp.gvt2.com

DNS:ssl.gstatic.com, DNS:*.force.com, DNS:*.lightning.force.com, DNS:*.salesforce.com,
DNS:*.content.force.com, DNS:*.ap5.content.force.com, DNS:*.sfdcstatic.com,
DNS:*.demdex.net, DNS:salesforcecom.demdex.net, DNS:*.rlcdn.com, DNS:*.krxd.net,
DNS:*.partners.salesforce.com, DNS:*.everesttech.net

To create a new root CA certificate, use a Linux machine with an OpenSSL version of 1.0.1e or later.

Create the root CA certificate key. This signs all issued certificates.

openssl genrsa -out rootCA.key.pem 2048

Create the self-signed root CA certificate, with the key generated in Step 2.

openssl req -x509 -new -nodes -key rootCA.key -days 365 -out rootCA.crt

Verify the root certificate.

Import the certificate from the Enterprise CA to the Trusted Root Certification Authorities store in the client browser.

Install the root CA certificate and intermediate CA certificate.

To create a new encryption key pair, use OpenSSL as shown below:

openssl genrsa -out proxyserver.key 1024

For the application to be optimized, create a Certificate Signing Request (CSR), key pair, and other needed attributes, such as Common Name, Company and SubjAltName.

openssl req -new -key server.key -out server.csr
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
NGSSL Demo Certificate
X509v3 Subject Key Identifier:
65:C1:42:98:47:81:0E:04:7A:7D:83:A7:43:C9:A3:B8:1F:DB:BF:1E
X509v3 Authority Key Identifier:
keyid:8C:F6:0A:BC:E4:EB:2C:D9:6B:68:95:09:1B:B5:82:66:CE:ED:6B:77
X509v3 Subject Alternative Name:
DNS:*.google.com, DNS:*.android.com, DNS:*.appengine.google.com, DNS:*.cloud.google.com,
DNS:*.google-analytics.com, DNS:*.google.ca, DNS:*.google.cl, DNS:*.google.co.in,
DNS:*.google.co.jp, DNS:*.google.co.uk, DNS:*.google.com.ar, DNS:*.google.com.au,
DNS:*.google.com.br, DNS:*.google.com.co, DNS:*.google.com.mx, DNS:*.google.com.tr,
DNS:*.google.com.vn, DNS:*.google.de, DNS:*.google.es, DNS:*.google.fr, DNS:*.google.hu,
DNS:*.google.it, DNS:*.google.nl, DNS:*.google.pl, DNS:*.google.pt,
DNS:*.googleadapis.com, DNS:*.googleapis.cn, DNS:*.googlecommerce.com,
DNS:*.googlevideo.com, DNS:*.gstatic.cn, DNS:*.gstatic.com, DNS:*.gvt1.com,
DNS:*.gvt2.com, DNS:*.metric.gstatic.com, DNS:*.urchin.com, DNS:*.url.google.com,
DNS:*.youtube-nocookie.com, DNS:*.youtube.com, DNS:*.youtubeeducation.com,
DNS:*.ytimg.com, DNS:android.clients.google.com, DNS:android.com, DNS:g.co, DNS:goo.gl,
DNS:google-analytics.com, DNS:google.com, DNS:googlecommerce.com, DNS:urchin.com,
DNS:www.goo.gl, DNS:youtu.be, DNS:youtube.com, DNS:youtubeeducation.com

To create a new proxy server certificate, sign the above generated CSR with your existing Enterprise Root CA, or the one created above. This will generate a .crt or .pem certifcate file.

1. Refer to your browser’s Settings or Options menu for that browser’s Certificates and Import locations.

2. Import the certificate.

3. Clear the browser cache.

4. Reload the browser for the cloud application.

   The browser will pick up the new certificate.

Cisco WAAS allows importing certificates with PKCS12 format. To generate the PKCS12 format from the certificate file and your private key, run the open ssl command.

openssl pkcs12 -export -out server.p12 -inkey proxyserver.key -in proxyserver.crt
-certfile CACert.crt

To import this certificate into the Cisco WAAS device group, run the crypto import EXEC command and thereafter be used in the accelerated server configuration as server-cert-key.

WAE# crypto import pkcs12 newcert.p12 pkcs12{disk| ftp | http | sftp | tftp}

Follow these guidelines for importing the certificate:

From the Cisco WAAS Central Manager menu, choose Device Groups > device-group-name.

Select the device group to enable for SMART-SSL settings.

From the Cisco WAAS Central Manager menu, choose Configure > Acceleration > Enabled Features.

To enable SMART SSL acceleration, at the Accelerator Optimization pane, check the SSL Interposer (SSL Accelerator V2) check box.

To create an SSL accelerated service for the device group, choose Acceleration > SSL Accelerated Services.

Click Create.

At the SSL Accelerated Service pane, enter the name of your service, and check the In service box.

At the Server Addresses pane:

1. In the IP Address field, enter Any.

2. In the Server Port field, enter 443.

3. Click Add.

At the Certificate and Private Key pane:

1. Click Import Existing Certificate and Optionally Private Key.

2. Click Upload File in PKCS#12 Format.

3. In the Password field, enter the password to be used to export the certificate.

4. Use the Browse button to locate the certificate to be imported.

5. Click Import to import the certificate.

   A confirmation screen appears, with the certificate information.

To complete the configuration of the SSL-accelerated service to use single sided optimization, click Submit.

To monitor the SMART-SSL accelerated service optimization statistics:

To create a new Certificate Signing Request (CSR) with the relevant server domain names of the Microsoft Office 365 application in the subject alternative names extension of the certificate, log in to the Microsoft Management Console (MMC), OpenSSL, or other available customer tool.

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ec:aa:9b:10:fa:9d:09:95
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=California, L=San Jose, O=Cisco     
        Systems Inc, OU=WAAS, 
        CN=Cisco_WAAS_CA/emailAddress=support@cisco.com
        Validity
            Not Before: Jul 31 06:49:56 2013 GMT
            Not After : Aug 30 06:49:56 2013 GMT
        Subject: C=US, ST=California, L=San Jose, O=Cisco   
                Systems Inc, OU=WAAS,    
                CN=Office365/emailAddress=support@cisco.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:c6:85:0d:f9:df:4e:4f:c4:53:d5:3e:0f:c4:cb:
                    53:42:34:34:7d:92:7f:ea:c1:75:0b:21:3f:5f:a1:
                    be:34:f1:40:c3:32:52:a1:05:79:26:7b:a3:29:c5:
                    5e:9f:3f:92:6b:d1:b2:fd:bc:c9:2b:8b:e2:9f:1a:
                    91:83:9b:c8:7f:3f:d9:56:92:75:be:b6:ed:39:39:
                    2f:1a:2f:ba:39:1b:06:76:0a:17:b5:f0:ec:dd:4c:
                    fa:94:be:ea:7c:e0:4e:51:b4:d2:75:4d:8b:d9:6e:
                    de:34:10:c7:c5:e8:97:5f:f2:7f:97:1e:9a:e0:e2:
                    fc:b4:58:11:45:82:19:14:11
Exponent: 65537 (0x10001)
     X509v3 extensions:
         X509v3 Basic Constraints: 
                CA:FALSE
         X509v3 Key Usage: 
         	Digital Signature, Non Repudiation, Key Encipherment
         X509v3 Subject Alternative Name: 
DNS.1 = *.virtualearth.net; DNS.2 = *.msocdn.com; DNS.3 = *.office365.com; DNS.4 = *.outlook.com; DNS.5 = outlook.com; DNS.6 = *.microsoftonline.com; DNS.7 = *.res.outlook.com; DNS.8 = *.googleapis.com; DNS.9 = *.google-analytics.com; DNS.10 = *.google.com; DNS.11 = *.googleusercontent.com; DNS.12 = *.gstatic.com; DNS.13 = *.microsoftonline-p.com; DNS.14 = *.aadcdn.microsoftonline-p.com; DNS.15 = *.aspnetcdn.com; DNS.16 = *.client.hip.live.com; DNS.17 = *.hip.live.com; DNS.18 = *.infra.lync.com; DNS.19 = *.linkedinlabs.com; DNS.20 = *.live.com; DNS.21 = *.lync.com; DNS.22 = *.microsoft.com; DNS.23 = *.microsoftonline-p.net; DNS.24 = *.microsoftonlineimages.com; DNS.25 = *.microsoftonlinesupport.net; DNS.26 = *.msecnd.net; DNS.27 = *.msocdn.com; DNS.28 = *.office.net; DNS.29 = *.office365.com; DNS.30 = *.officeapps.live.com; DNS.31 = *.officecdn.microsoft.com; DNS.32 = *.online.lync.com
DNS.33 = *.onmicrosoft.com; DNS.34 = *.sharepoint.com; DNS.35 = *.sharepointonline.com;DNS.36 = *.telemetry.microsoft.com; DNS.37 = *.testexchangeconnectivity.com; DNS.38 = *.vo.mscend.net; DNS.39 = *.webtrends.com; DNS.40 = *.office.com; DNS.41 = *.portal.office.com; 

Signature Algorithm: sha1WithRSAEncryption
        46:db:34:7f:c0:8e:13:81:67:0b:3c:8d:15:3a:ee:1f:c7:cf:
        d1:6b:de:00:2a:35:9b:13:d6:bf:79:43:ce:31:c6:f9:de:f7:
        20:1f:0e:86:9e:d4:91:01:57:a2:7b:fe:91:00:de:cf:58:90:
        85:97:49:b3:11:4c:e9:05:d0:a1:a7:73:7e:50:64:8f:80:f4:
        ec:fa:a7:bb:7a:c2:df:5e:c5:e3:a8:52:c4:31:4e:8e:53:36:
        59:e9:0f:27:82:71:4e:3b:79:a4:c9:4f:18:7e:06:7a:0c:34:
        0a:cf:3c:3e:73:73:5a:52:7d:03:a0:75:50:5a:d4:a5:8b:a9:

Submit the certificate to the Enterprise CA.

Import the signed certificate from the Enterprise CA to the Trusted Root Certification Authorities store.

To ensure that the created accelerated service proxy certificate will be authenticated and accepted by the client browser, the CA certificate used to sign this accelerated service certificate must be present in the client browser root CA certificate store.

1. Refer to your browser’s Settings or Options menu for that browser’s Certificates and Import locations.

2. Import the certificate.

3. Clear the browser cache.

4. Reload the browser for the cloud application.

   The browser will pick up the new certificate.

Register your Azure vWAAS device with the Cisco WAAS Central Manager. If the Cisco WAAS Central Manager is in a different network add routes for reachability.

Create a Microsoft Office 365 accelerated service for the device group:

1. Choose Acceleration > SSL Accelerated Services.

2. Click Create.

   The Creating New SSL Accelerated Service window appears.

At the SSL Accelerated Service pane:

1. In the Service Name field, enter the name of the service, o365.

2. To enable this service, check the In Service check box.

3. To match subject alternative names, check the Match Server Name Indication check box or run the match sni command on the core WAAS device.

   Consider the following guidelines to match subject alternative names:

   • If enabled, the SSL accelerator parses the initial SSL connection setup message for the destination hostname (in the SSL protocol extension called Server Name Indication) and uses that to match it with the Subject Alternate Names list in the SSL certificate on the WAAS device.

   • We recommend this setting for optimizing cloud-based SaaS applications to avoid namespace/certificate mismatch errors that are caused due to the changing nature of the SaaS server domains and IP addresses.

   • Most current browsers provide Server Name Indication (SNI) support. Ensure that you use a browser that supports SNI.

   • The Match Server Name Indication option is available on devices running Cisco WAAS Version 5.3.5 and later.

4. (Optional) Provide a short description.

At the Server addresses pane:

1. To specify the server IP address of the accelerated server, in the Server Port field, enter the keyword Any.

2. To direct traffic to port 443, in the Server Port field enter 443.

3. Click Add.

At the Certificate and Private Key pane:

1. Click Import Existing Certificate and Optionally Private Key.

2. Click Upload File in PKCS#12 Format.

3. In the Password field, enter the password to be used to export the certificate.

4. Use the Browse button to locate the certificate to be imported.

5. Click Import to import the certificate.

   A confirmation screen appears, with the certificate information.

To complete the configuration of the Microsoft Office 365, click Submit.

To monitor accelerated service optimization statistics, see SSL Acceleration Charts in the chapter "Monitoring Your Cisco WAAS Network."