Cisco 7100 Series Especificaciones descargar pdf (Pagina 45)

Intranet VPN Business Scenario 3-15

Configuring IKE Policies

Additional Conﬁguration Required for IKE Policies

Depending on which authentication method you specify in your IKE policies, you need to

complete an additional companion conﬁguration before IKE and IPSec can successfully

use the IKE policies.

Each authentication method requires an additional companion conﬁguration as follows:

• RSA signatures method:

If you specify RSA signatures as the authentication method in a policy, you must

conﬁgure the peers to obtain certiﬁcates from a Certiﬁcation Authority (CA). (And, of

course, the CA must be properly conﬁgured to issue the certiﬁcates.) Conﬁgure this

certiﬁcate support as described in the “Conﬁguring Certiﬁcation Authority

Interoperability” chapter of the Security Conﬁguration Guide.

The certiﬁcates are used by each peer to securely exchange public keys. (RSA

signatures requires that each peer has the remote peer’s public signature key.) When

both peers have valid certiﬁcates, they will automatically exchange public keys with

each other as part of any IKE negotiation in which RSA signatures are used.

• RSA encrypted nonces method:

If you specify RSA encrypted nonces as the authentication method in a policy, you need

to ensure that each peer has the other peers’ public keys.

Unlike RSA signatures, the RSA encrypted nonces method does not use certiﬁcates to

exchange public keys. Instead, you ensure that each peer has the others’ public keys by

doing the following:

— Manually conﬁgure RSA keys as described in the “Conﬁguring Internet Key

Exchange Security Protocol” chapter of the Security Conﬁguration Guide.

— Ensure that an IKE exchange using RSA signatures has already occurred between

the peers. (The peers’ public keys are exchanged during the RSA-signatures-based

IKE negotiations.)

To make this happen, specify two policies: a higher-priority policy with RSA

encrypted nonces, and a lower-priority policy with RSA signatures. When IKE

negotiations occur, RSA signatures will be used the ﬁrst time because the peers do

not yet have each others’ public keys. Then, future IKE negotiations will be able to

use RSA-encrypted nonces because the public keys will have been exchanged.

Of course, this alternative requires that you have CA support conﬁgured.

1 2 ... 40 41 42 43 44 45 46 47 48 49 50 ... 111 112

Sin comentarios

Cisco 7100 Series Especificaciones Pagina 45