07-28-2003 04:32 AM - edited 02-21-2020 12:41 PM
Dear All,
I have some questions about authentication. When I
read the vpn3000 concentrator documentation, e.g.
the paper talks about digital certificates.
Are the certificates used to do authentication with digital signatures or authentication with public key encryption or do I have the choice what I want to do?
If I want to do mainmode with digital certificates, does the initiator need a fix IP or is a dynamic IP possible?
Thank you!
Christian
07-29-2003 04:20 PM
Devices such as routers and VPN concentrators can use certificates for authentication purposes. By default, the logic applied when they evaluate a certificate presented for authentication is:
Is the certificate valid (date/time/crl)
Is the certificate from the same root CA
Although later code versions have more features incorporated around certificates and attributes, it's very clunky with concepts like overlapping cryptographic domains or realms.
No, you don't need a fixed address when using certificates.
Cerficiates have no role in the IPSec encryption process
08-04-2003 03:07 AM
Thank you for your response.
I read the paper "Certificate Security Attribute-Based Access Control". If I understand the paper right, now I can implement differentiated vpn access for "departments" or groups of certificate owners, where one attribute (e.g. OU) tells me, that this group gets access or not?
That all depends on, how my pki hierarchy looks like.
Thank you!
Christian
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: