Using the Certificates

Nov 15,2009 by alperen

Using the Certificates

Once the certificate is installed on the VPN concentrator, you must change settings for IKE negotiation. This requires two screen entries, the IKE transform to be used and the IPSec SA information.

IKE Configuration

Use the Manager navigation to locate the Configuration | System | Tunneling Protocols IPSec | IKE Proposals screen, shown in Figure 14-43. This screen displays both the Active and Inactive IKE options available on the Concentrator.

Figure 14-43: IKE Proposal options

You can change an existing Active proposal from preshared keys to certificates or create a new one. Select an existing proposal, and then click the Modify button or click the Add button. Either way, a screen similar to the one shown in Figure 14-44 appears.

Figure 14-44: IKE Proposal option to be modified

You only have one choice here. Use the Authentication mode drop-down list and select RSA Digital Certificate. Then click the Apply button.

IPSec Configuration

Use the Manager navigation to locate the Configuration | Policy Management | Traffic Management | Security Associations | Modify screen for the appropriate IPSec SA. The resulting screen is large, but the bottom panel, as shown in Figure 14-45, is all that must be changed.

Figure 14-45: Defining the IKE parameters for the IPSec SA

Use the Digital Certificate drop-down list to select the appropriate certificate name.

If necessary, use the IKE Proposal drop-down list to select the IKE proposal defined in the last section, and then click Apply. Configure Cisco