Cisco PIX 525 Spécifications télécharger pdf (Page 221)

6-9

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Using Certification Authorities

CAs can also revoke certificates for peers that will no longer participate in IPSec. Revoked certificates

are not recognized as valid by other peers. Revoked certificates are listed in a certificate revocation list

(CRL), which each peer may check before accepting another peer’s certificate.

Some CAs have a registration authority (RA) as part of their implementation. An RA is essentially a

server that acts as a proxy for the CA so that CA functions can continue when the CA is off line.

Supported CA Servers

Currently, the PIX Firewall supports the following CA servers:

• VeriSign support is provided through the VeriSign Private Certificate Services (PCS) and the OnSite

service, which lets you establish an in-house CA system for issuing digital certificates.

• Entrust, Entrust VPN Connector, version 4.1 (build 4.1.0.337) or higher. The Entrust CA server is

an in-house CA server solution.

• Baltimore Technologies, UniCERT Certificate Management System, version 3.1.2 or higher. The

Baltimore CA server is an in-house CA server solution.

• Microsoft Windows 2003 Server, Microsoft Windows 2000, specifically the Windows 2000 Advanced

Server, version 5.00.2195 or higher.The Windows 2000 CA server is an in-house CA server solution.

Note The Microsoft CA must be a standalone root CA, not subordinated, or it will be rejected and a syslog

CRYPTO_PKI: WARNING message will be entered. Example:

CRYPTO_PKI: WARNING: A

certificate chain could not be constructed while selecting certificate status.

Configuring the PIX Firewall to Use Certificates

For site-to-site VPNs, you must perform this series of steps for each PIX Firewall. For remote access

VPNs, perform these steps for each PIX

Firewall and each remote access VPN client.

Note You need to have a CA available to your network before you configure CA. The CA should support

Cisco’s PKI protocol, the simple certificate enrollment protocol.

When certificates are revoked, they are added to a certificate revocation list (CRL). When you implement

authentication using certificates, you can choose to use CRLs or not. Using CRLs lets you easily revoke

certificates before they expire, but the CRL is generally only maintained by the CA or its authorized

registration authority (RA). If you are using CRLs and the connection to the CA or RA is not available

when authentication is requested, the authentication request will fail.

Note Be sure that the PIX Firewall clock is set to GMT, month, day, and year before configuring the CA.

Otherwise, the CA may reject or allow certificates based on an incorrect timestamp. Cisco’s PKI protocol

uses the clock to make sure that a CRL is not expired. The lifetime of a certificate and CRL is checked

in GMT time. If you are using IPSec with certificates, set the PIX

Firewall clock to GMT to ensure that

CRL checking works correctly.

1 2 ... 216 217 218 219 220 221 222 223 224 225 226 ... 465 466

Pas de commentaire

Cisco PIX 525 Spécifications Page 221