Enterasys-networks Security Router X-PeditionTM Uživatelský manuál stáhnout pdf (Strana 350)

VPN Configuration Overview

14-28 Configuring the Virtual Private Network

– crypto ca certificate chain

– no certificate - The serial number can be found in: show crypto ca certificates

• Remove CA identities and all associated CA and IPSec client certificates by entering

crypto ca identity <ca name>

Configuring PKI

The main steps to configure PKI are as follows:

• Obtain the CA name and URL

• Identify the CA, retrieve and authenticate the certificate

• Verify the root certificate was received

• Configure CA retrieval attributes and update CRLs

• Specify a host(s) for the CRL mechanism

• Enroll in an end-entity certificate

• Verify the end-entity certificate is valid

• Optional: change the enrollment retry period and count

For step-by-step instructions, refer to the following PKI Certificate example.

PKI Certificate Enrollment Example

This PKI example illustrates authenticating to and enrolling with a Certificate Authority (CA) for

an end-entity certificate for the IPSec gateway. Local IPSec uses end-entity certificates to establish

SAs for IPSec connectivity. You must authenticate against all CAs which may have provided

certificates to any of the remote systems that may be building IPSec links to the local system.

1. Begin by asking your CA administrator for your CA name and URL.

The CA’s URL defines its IP address, path and default port (80). You can resolve the CA server

address manually by pinging its IP address.

2. Be sure that the XSR time setting is correct according to the UTC time zone so that it is

synchronized with the CA’s time. For example:

XSR#clock timezone -5 0

3. Specify the enrollment URL, authenticate the CA and retrieve the root certificate. Check your

CA Website to ensure the printed fingerprint matches the CA's fingerprint, which is retrieved

from the CA itself, to verify the CA is legitimate. If bona fide, accept the certificate, if not,

check that the certificate is deleted and not stored in the CA database. In some cases you may

need to specify a particular CA identity name. Consult your administrator for more details.

XSR(config)#crypto ca identity ldapca

XSR(config-ca-identity)#enrollment url http://192.168.1.33/certsrv/mscep/

mscep.dll/

XSR(config-ca-identity)#exit

XSR(config)#crypto ca authenticate ldapca

Note: If you have multiple CAs in a chained environment, you need only identify each CA and obtain

each CA certificate within the chain using the

crypto ca identity and crypto ca

authenticate

commands, respectively, as illustrated in Step 2 on page 14-28.

1 2 ... 345 346 347 348 349 350 351 352 353 354 355 ... 465 466

Komentáře k této Příručce

Žádné komentáře

Enterasys-networks Security Router X-PeditionTM Uživatelský manuál Strana 350

Komentáře k této Příručce

Související produkty a manuály pro Hardware Enterasys-networks Security Router X-PeditionTM