Site-to-Site VPN not use pre-shared key

Unanswered Question
Jul 14th, 2009
User Badges:

I need help for this problem: I am using a Cisco 877 router to build IPSec/GRE tunnel over Internet to a Nokia firewall / Checkpoint VPN-1 NG box. We used to build the IPSec tunnel using pre-shared key at both ends, which works well. But this time the Nokia firewall end does not allow it, and always request "ISAKMP: auth RSA sig" instead (got it from debug crypto ISAKMP). There is a way to fix the problem by changing global settings for the firewall, but it is not allowed because other IPSec tunnels already terminated on that box.

So we have to use the router's self signed cert instead of pre-shared key for crypto. But I don't know what parameters to specify when configing "crypto key public-chain rsa". What information do I need to ask the Nokia firewall admin for? and what he has to do to manually generate/exchange the cert? I wonder if anyone has done this before, and please help if you do.

Thanks in advance


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
kwillacey Tue, 07/14/2009 - 09:14
User Badges:
  • Bronze, 100 points or more

I have only done this between two routers and a Microsoft CA server, but in the simplest form all you need to do is enroll with the CA server and request a certificate which the CA server would then grant and both devices would have to do that. The below config is using a Microsoft CA server.

crypto key generate rsa general-keys modulus 1024

crypto pki trustpoint

enrollment mode ra

enrollment url http:///certsrv/mscep/mscep.dll

revocation-check crl

auto-enroll 70

crypto ca authenticate

crypto ca enroll

Maybe these two links can help

yanzhu Tue, 07/14/2009 - 09:54
User Badges:

There is no internal CA server available and I am not sure if the firewall admin would agree to enroll to an external CA server. Is there any other way to fix it?

kwillacey Tue, 07/14/2009 - 09:59
User Badges:
  • Bronze, 100 points or more

Its either the cisco or the checkpoint will act as a CA server or you have no choice but to change the authentication to pre shared keys. AFAIK it cant work without a CA server.

yanzhu Tue, 07/14/2009 - 20:36
User Badges:

Is it possible for the router and the firewall exchange the RSA Sig directly?

I saw there were three options for auth:


RSA-Encr (via CA server)



This Discussion