Note: VMware NSX for vSphere 6.1.4 includes updates that address the POODLE vulnerability in NSX components not covered in this article. VMware strongly recommends upgrading to NSX 6.1.4 or later. For more information, see the NSX 6.1.4 Release Notes.
Disable SSLv3 Support on NSX Edge SSL VPN Services:
To disable SSLv3 support in NSX Edge SSL VPN in your environment, use the sslVersionList parameter in the following API call to deny SSLv3 (and to allow the desired SSL versions) on each NSX Edge.
API Method:
PUT https://<nsxmgr-ip>/api/4.0/edges/<edge-id>/sslvpn/config/server/
Example request body:
In this example, we enable TLSv1, TLSv1_2, and TLSv1_1, and we disable SSLv3 by omitting it from the sslVersionList:
<serverSettings>
<serverAddresses>
<ipAddress>x.x.x.x</ipAddress>
</serverAddresses>
<port>443</port>
<sslVersionList>
<version>TLSv1</version>
<version>TLSv1_2</version>
<version>TLSv1_1</version>
</sslVersionList>
<cipherList>
<cipher>RC4-MD5</cipher>
<cipher>AES128-SHA</cipher>
<cipher>AES256-SHA</cipher>
<cipherDES-CBC3-SHA</cipher>
</cipherList>
</serverSettings>
If the sslVersionList parameter is blank, all SSL versions including SSLv3 are allowed.
Enable SSLv3 Support on NSX Edge SSLVPN Services:
To re-enable SSLv3 support in NSX Edge SSL VPN, use the sslVersionList parameter in the following API call to allow SSLv3 and other desired encryption protocols on each NSX Edge.
API Method:
PUT https://<nsxmgr-ip>/api/4.0/edges/<edge-id>/sslvpn/config/server/
Example request body:
In this example, we enable SSLv3, TLSv1, TLSv1_2, and TLSv1_1:
<serverSettings>
<serverAddresses>
<ipAddress>x.x.x.x</ipAddress>
</serverAddresses>
<port>443</port>
<sslVersionList>
<version>SSLv3</version>
<version>TLSv1</version>
<version>TLSv1_2</version>
<version>TLSv1_1</version>
</sslVersionList>
<cipherList>
<cipher>RC4-MD5</cipher>
<cipher>AES128-SHA</cipher>
<cipher>AES256-SHA</cipher>
<cipherDES-CBC3-SHA</cipher>
</cipherList>
</serverSettings>
If the sslVersionList parameter is blank, all SSL versions including SSLv3 are allowed.