Site-to-Site VPN with certificates

Unanswered Question
Jul 6th, 2010
User Badges:

Hi everyone,


I have a remote user with an ASA-5505 which needs to establish vpn tunnels to two different ASA-5520's. The remote user has a dynamic IP for his outside address.


I can configure it to work with DefaultL2LGroup for the pre-shared-key, but that creates security conflicts with my remote VPN users which use DefaultL2LGroup.


Is there a way to use digital certificates which I can generate from each ASA-5520, and manualy import the public keys into the ASA-5505.


I do mave multiple ASA-5505's but each only has to establish tunenls to the two different 5520's.


All the docutmention I can find uses a Microsoft CA and I want to set this up (unless it's a security breach) without one.


Is there a way to do this like with SSH where I can copy the public key to the remote end?


Thanks,


Carlos

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Marcin Latosiewicz Tue, 07/06/2010 - 07:54
User Badges:
  • Cisco Employee,

Carlos,


Yes you can.


ASA supports both SCEP and copy-and-paste enrollment methods.

http://www.aboutcisco.biz/en/US/products/ps6120/products_configuration_example09186a00808a61cd.shtml

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080aa5be1.shtml


Please note that CRL/OCSP has to be publicly available in a scenario like this (or checking disabled).


Marcin


edit: spelling and added links.

Actions

This Discussion