Discussion

Use the following command to display information about the local certificate:
aviva@RouterA> show security pki local-certificate
Certificate identifier: local-entrust
Issued to: RouterA.mycompany.com, Issued by: mycompany
Validity:
Not before: 2005 Nov 21st, 23:28:22 GMT
Not after: 2008 Nov 21st, 23:58:22 GMT
Public key algorithm: rsaEncryption(1024 bits)
Public key verification status: Passed
The first line of the output shows the name of the certificate—here, local-entrust.
The second line shows the router and company to whom the certificate has been
issued. The certificate is valid for three years from the date of issue.
When you have the signed local certificate, configure IKE and IPSec to use it. The
configuration is more involved than that shown in Recipe 3.3 because this recipe
uses fewer of the default values.
In configuring IKE, the set ike proposal command has IKE use the digital certificate
for authentication (with the option authentication-method rsa-signatures) instead
of the default preshared keys. In the IKE policy, the set proposals command references
the IKE proposal. The second and third commands give the fully qualified
domain names of the local and remote routers that are the IPSec tunnel peers. The
last command configures the name of the local router’s digital certificate. Finally,
define a rule for the IKE SA. This recipe creates a rule named digital-cert-rule. The
first set term command defines the IP address of the remote end of the IPSec tunnel,
and the second associates the IKE policy with the SA so that matching packets can be
sent across the tunnel.
Next, configure IPSec. The service set is the same as that shown in Recipe 3.3, with
the addition of the set ipsec-vpn-options trusted-ca command, which points to the
CA you defined with the set security pki ca-profile command. Finally, use the set
ipsec-vpn establish-tunnels immediately command to create the IPSec tunnel immediately
after the configuration is activated rather than wait for traffic before setting it
up.
In this recipe, the configuration for the services interface, the physical interface, and
the IGP is the same as in Recipe 3.3. And again, configure the remote security router
in the same way.
To check the operation of IKE and IPSec, use the commands shown in Recipe 3.3.
Use the show services ipsec-vpn certificates command to check that the correct
digital certificates are being used to establish the IPSec tunnel:
aviva@RouterA> show services ipsec-vpn certificates
Service set: ipsec-domain, Total entries: 3
Certificate cache entry: 3
Flags: Non-root Trusted
Issued to: RouterB.mycompany.com, Issued by: mycompany
126 | Chapter 3: IPSec
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.