Cisco PIX 525 Spécifications télécharger pdf (Page 257)

7-15

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 7 Site-to-Site VPN Configuration Examples

Using PIX Firewall with an In-House CA

Configuring PIX Firewall 1 for an In-House CA

Follow these steps to configure PIX Firewall 1 for use with an in-house CA. These steps are similar to

the procedure shown in “

Using PIX Firewall with a VeriSign CA.”

Step 1 Define a host name:

hostname NewYork

Step 2 Define the domain name:

domain-name example.com

Step 3 Generate the PIX Firewall RSA key pair:

ca generate rsa key 512

This command is entered at the command line and does not get stored in the configuration.

Step 4 Define CA-related enrollment commands:

ca identity abcd 10.1.0.2 10.1.0.2

ca configure abcd ra 2 20 crloptional

These commands are stored in the configuration. 2 is the retry period, 20 is the retry count, and the

crloptional option disables CRL checking.

Note For a Microsoft CA server, specify the internal network address followed by a colon and the

pathname to the server executable, such as 10.1.0.2:/CERTSRV/mscep/mscep.dll.

Step 5 Authenticate the CA by obtaining its public key and its certificate:

ca authenticate abcd

This command is entered at the command line and does not get stored in the configuration.

Step 6 Request signed certificates from your CA for your PIX Firewall’s RSA key pair:

ca enroll abcd cisco

Before entering this command, contact your CA administrator because they will have to authenticate

your PIX

Firewall manually before granting its certificate.

“cisco” is a challenge password. This can be anything. This command is entered at the command line

and does not get stored in the configuration.

Step 7 Verify that the enrollment process was successful using the show ca certificate command:

show ca certificate

Step 8 Save keys and certificates, and the CA commands (except those indicated) in Flash memory:

ca save all

write memory

Note Use the ca save all command any time you add, change, or delete ca commands in the

configuration. This command is not stored in the configuration.

1 2 ... 252 253 254 255 256 257 258 259 260 261 262 ... 465 466

Pas de commentaire

Cisco PIX 525 Spécifications Page 257