Cisco 3002 - VPN Hardware Client Podręcznik Użytkownika Pobierz pdf (Strona 124)

12 Administration

12-16

VPN 3002 Hardware Client User Guide

CAs issue root certificates (also known as trusted or signing certificates). They may also issue

subordinate trusted certificates. Finally, CAs issue identity certificates, which are the certificates for

specific systems or hosts. There must be at least one identity certificate (and its root certificate) on a

given VPN 3002; there may be more than one root certificate.

During IKE (IPSec) Phase 1 authentication, the communicating parties exchange certificate and key

information, and they use the public-key / private-key pairs to generate a hash value; if the hash values

match, the client is authenticated.

The VPN 3002 supports X.509 digital certificates (International Telecommunications Union

Recommendation X.509), including SSL (Secure Sockets Layer) certificates that are self-signed or

issued in a PKI context.

On the VPN 3002, digital certificates are stored as encrypted files in a secure area of flash memory. They

do not require you to click

Save Needed to store them, and they are not visible under Administration | Config

File Management

After you install a digital certificate on the VPN 3002, you can use it to negotiate an IPSec tunnel by

selecting the check box

Use Certificate on the Configuration | System | Tunneling Protocols | IPSec screen.

The VPN3002 can have only one SSL certificate installed. If you generate a self-signed SSL certificate,

it replaces any installed PKI-context SSL certificate; and vice-versa.

For information on using SSL certificates, see Installing the SSL certificate in your browser in Chapter

1. See also

Configuration | System | Management Protocols | HTTP/HTTPS and Telnet, and Configuration | System

| Management Protocols | SSL

Digital certificates carry a timestamp that determines a time frame for their validity. Therefore, it is

essential that the time on the VPN 3002 is correct and synchronized with network time.

Configuration |

System | General | Time and Date

Figure 12-20: Administration | Certificate Management screen

Installing digital certificates on the VPN 3002

Installing a digital certificate on the VPN 3002 requires these steps:

1 Use the

Administration | Certificate Management | Enrollment screen to generate a certificate request.

Save the request as a file, or copy it to the clipboard.

2 Process the certificate request to the chosen CA, usually using the CA’s Web interface. Most CAs let

you submit the request by pasting from the clipboard; otherwise, you can send a file.

3 From the CA, receive root (and perhaps subordinate) and identity certificates. Save them as text files

on your PC or other reachable network host; do not open them or install them in your browser.

4 Use the

Administration | Certificate Management | Installation screen to:

1 2 ... 119 120 121 122 123 124 125 126 127 128 129 ... 219 220

Brak uwag

Cisco 3002 - VPN Hardware Client Podręcznik Użytkownika Strona 124