Used to explicitly configure the TLS ciphers that would be supported by the device. This OID is added because the current cipher categorization into LOW-MEDIUM-HIGH is fading away. Following are some of the scenarios where explicit configuration of allowed ciphers are required: Scenario 1) A customer may need HIGH encryption strength ciphers only, but for interoperability they may need to enable specific LOW/MEDIM cipher. Eg - RC4 which is a LOW Strength cipher is required for interoperability with Windows when HIGH encryption strength is set. Scenario 2) Customers may want to disable specific ciphers as and when security vulnerabilities are detected in them. The current list of ciphers and their standard Cipher Suite Values: | |Name(OpenSSL) |NIST Name |Cipher Suite|FIPS 140-2 |Supported in | | |Value |Compliant |TLS protocol versions | | |AES256-GCM-SHA384 |TLS_RSA_WITH_AES_256_GCM_SHA384 |{0x009D} | Yes |TLS 1.2 | |AES256-SHA256 |TLS-RSA-WITH-AES-256-CBC-SHA256 |{0x003D} | Yes |TLS 1.0/TLS 1.1/TLS 1.2| |AES256-SHA |TLS-RSA-WITH-AES-256-CBC-SHA |{0x0035} | Yes |TLS 1.0/TLS 1.1/TLS 1.2| |DES-CBC3-SHA |TLS-RSA-WITH-3DES-EDE-CBC-SHA |{0x000A} | Yes |TLS 1.0/TLS 1.1/TLS 1.2| |AES128-GCM-SHA256 |TLS_RSA_WITH_AES_128_GCM_SHA256 |{0x009C} | Yes |TLS 1.2 | |AES128-SHA256 |TLS-RSA-WITH-AES-128-CBC-SHA256 |{0x003C} | Yes |TLS 1.0/TLS 1.1/TLS 1.2| |AES128-SHA |TLS-RSA-WITH-AES-128-CBC-SHA |{0x002F} | Yes |TLS 1.0/TLS 1.1/TLS 1.2| |RC4-SHA |TLS-RSA-WITH-RC4-128-SHA |{0x0005} | No |TLS 1.0/TLS 1.1/TLS 1.2| |RC4-MD5 |TLS-RSA-WITH-RC4-128-MD5 |{0x0004} | No |TLS 1.0/TLS 1.1/TLS 1.2| | SNMP Operations: SNMPGet would return the a comma separated list of Cipher Suite Values configured. SNMPSet should be performed with comma separated list of Cipher Suite Values. Eg: To configure AES256-GCM-SHA384 and AES256-SHA256,set has to be performed with '0x009D,0x003D' Note: No comma required for single OID[Neeraj Gupta: ] cipher suite. Errors returned: BAD VALUE(v1) or WRONG VALUE(v2/v3) will be returned when invalid/unsupported cipher OIDs are configured GENERIC ERROR will be returned and the npSecurityOpenSSLFIPSErrorTable will be updated with the appropriate error bit in the following cases 1) TLS 1.2 is disabled and user tries to configure ciphers supported only with TLS 1.2. 2) FIPS 140-2 is enabled and user tries to configure ciphers not allowed in FIPS 140-2 .