Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

Site to Site Between Cisco IOS router using isakmp profile and certificate Authentication

Introduction:

This document provides step-by-step instructions on how to configure site to site between 2 Cisco IOS router using the ISAKMP profile and USING Certificate from the Cisco IOS  CA server.In this document i will show you how to configure Cisco IOS router as a CA server and other router will get the certificate using auto enrollment.

This  document requires a basic understanding of Site to Site VPN configuration on the Cisco IOS router. 

Components Used:

Cisco 2691 Version 12.4(15)T14

I have used the same router for CA server and Site to Site VPN router.

Network Diagram:

SIte to site.JPG

Configure Cisco IOS router as a CA server.

1. Make sure hostname and the time is correct on the CA server.

2. Generate the RSA keys:

crypto key generate rsa general-keys label CA exportable

The name for the keys will be: CA

Choose the size of the key modulus in the range of 360 to 2048 for your

  General Purpose Keys. Choosing a key modulus greater than 512 may take

  a few minutes.

How many bits in the modulus [512]: 1024

% Generating 1024 bit RSA keys, keys will be exportable...[OK]

Sep 26 12:18:43.635: %SSH-5-ENABLED: SSH 1.99 has been enabled.

3. Export the keys to the nvram:

crypto key export rsa CA pem url nvram: 3des cisco123

% Key name: CA

Usage: General Purpose Key

Exporting public key...

Destination filename [CA.pub]?

% File 'CA.pub' already exists.

% Do you really want to overwrite it? [yes/no]: yes

Writing file to nvram:CA.pub

Exporting private key...

Destination filename [CA.prv]?

% File 'CA.prv' already exists.

% Do you really want to overwrite it? [yes/no]: yes

Writing file to nvram:CA.prv

4. Enable the certificate server:

crypto pki server CA

issuer-name CN=CA.mydomain.com L=RTP C=US

grant auto

lifetime crl 24

lifetime certificate 300

lifetime ca-certificate 365

cdp-url http://37.37.37.37/CA.cdp.CA.crl

no shut

%PKI-6-CS_GRANT_AUTO: All enrollment requests will be automatically granted.

%Some server settings cannot be changed after CA certificate generation.

% Please enter a passphrase to protect the private key

% or type Return to exit

Password: cisco123

Re-enter password: cisco123

% Exporting Certificate Server signing certificate and keys...

% Certificate Server enabled.

%PKI-6-CS_ENABLED: Certificate server now enabled.

Configuration of Site 1:

**Make sure time, hostname and domian-name is correct.

1. Generate the crypto RSA keys:

crypto key generate rsa

The name for the keys will be: india.mydomain.com

Choose the size of the key modulus in the range of 360 to 2048 for your

General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus [512]: 1024

% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

%SSH-5-ENABLED: SSH 1.99 has been enabled

2. Configure the trust-point for the auto-enrollment:

crypto ca trustpoint l2l

enrollment retry count 5

enrollment retry period 3

enrollment url http://37.37.37.37:80

revocation-check none

exit

3. Authenticate and Enoll the router to get the certificate from the CA server:

crypto ca authenticate l2l

Certificate has the following attributes:

       Fingerprint MD5: CD66EFFE A22C2FE6 DBE3361B F1A0BFFD

      Fingerprint SHA1: 2BC6E500 F0142832 4DC78D77 8976A2FF 2A5F47C0

% Do you accept this certificate? [yes/no]: yes

Trustpoint CA certificate accepted.

crypto ca enroll l2l

% Start certificate enrollment ..

% Create a challenge password. You will need to verbally provide this

   password to the CA Administrator in order to revoke your certificate.

   For security reasons your password will not be saved in the configuration.

   Please make a note of it.

Password: cisco123

Re-enter password: cisco123

% The subject name in the certificate will include: india.mydomain.com

% Include the router serial number in the subject name? [yes/no]: no

% Include an IP address in the subject name? [no]:

Request certificate from CA? [yes/no]: yes

% Certificate request sent to Certificate Authority

% The 'show crypto ca certificate l2l verbose' commandwill show the fingerprint.

Sep 26 11:00:57.729: CRYPTO_PKI:  Certificate Request Fingerprint MD5: 92916D78 3D902FEA C82B6BC3 62262801

Sep 26 11:00:57.737: CRYPTO_PKI:  Certificate Request Fingerprint SHA1: F9C8C5AD 9BE70B07 9C8DA166 574DE280 03B5B7B0

Sep 26 11:00:59.461: %PKI-6-CERTRET: Certificate received from Certificate Authority

4. Configure the router for the Site to Site VPN:

crypto isakmp policy 10

authentication rsa-sig

encryption 3des

hash md5

group 2

lifetime 86400

!

!

crypto isakmp profile testvpn

   self-identity fqdn

   ca trust-point l2l

   match identity host london.mydomain.com

!

!

crypto ipsec transform-set myset esp-3des esp-md5-hmac

!

!

access-list 110 permit ip 192.168.47.0 0.0.0.255 192.168.57.0 0.0.0.255

!

!

crypto map outside_map 1 ipsec-isakmp

set peer 57.57.57.1

set transform-set myset

set isakmp-profile testvpn

match address 110

!

!

interface FastEthernet0/0

ip address 47.47.47.1 255.255.255.0

crypto map outside_map

!

!

end

Configuration of Site 2.:

1. Make sure hostname and the time is correct on the CA server.

2. Generate the RSA keys:

crypto key generate rsa

The name for the keys will be: london.mydomain.com

Choose the size of the key modulus in the range of 360 to 2048 for your

General Purpose Keys. Choosing a key modulus greater than 512 may take   a few minutes.

How many bits in the modulus [512]: 1024

% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

%SSH-5-ENABLED: SSH 1.99 has been enabled

3. Configure the trust-point for the auto-enrollment:

crypto ca trustpoint l2l

enrollment retry count 5

enrollment retry period 3

enrollment url http://37.37.37.37:80

revocation-check none

exit

4. Authenticate and Enoll the router to get the certificate from the CA server:

crypto ca authenticate l2l

Certificate has the following attributes:

       Fingerprint MD5: CD66EFFE A22C2FE6 DBE3361B F1A0BFFD

      Fingerprint SHA1: 2BC6E500 F0142832 4DC78D77 8976A2FF 2A5F47C0

% Do you accept this certificate? [yes/no]: yes

Trustpoint CA certificate accepted.

crypto ca enroll l2l

% Start certificate enrollment ..

% Create a challenge password. You will need to verbally provide this password to the CA Administrator in order to revoke your certificate.

   For security reasons your password will not be saved in the configuration.

   Please make a note of it.

Password: cisco123

Re-enter password:cisco123

% The subject name in the certificate will include: london.mydomain.com

% Include the router serial number in the subject name? [yes/no]: no

% Include an IP address in the subject name? [no]:

Request certificate from CA? [yes/no]: yes

% Certificate request sent to Certificate Authority

% The 'show crypto ca certificate l2l verbose' command will show the fingerprint.

Sep 26 11:07:12.067: CRYPTO_PKI:  Certificate Request Fingerprint MD5: A2C865C1 8306C98A E597A3D5 F9C5D13C

Sep 26 11:07:12.075: CRYPTO_PKI:  Certificate Request Fingerprint SHA1: 6C7A55D0 91C033F6 B92321C5 8FB837F8 B4CF81E4

Sep 26 11:07:13.751: %PKI-6-CERTRET: Certificate received from Certificate Authority

5. Configure the router for the Site to Site VPN:

hostname london

!

!

ip domain name mydomain.com

!

!

crypto isakmp policy 10

authentication rsa-sig

encryption 3des

hash md5

group 2

lifetime 86400

!

!

crypto ipsec transform-set myset esp-3des esp-md5-hmac

!

!

crypto isakmp profile testvpn

   self-identity fqdn

   ca trust-point l2l

   match identity host india.mydomain.com

!

!

crypto map outside_map 10 ipsec-isakmp

set peer 47.47.47.1

set transform-set myset

set isakmp-profile testvpn

match address 110

!

!

interface FastEthernet0/0

ip address 57.57.57.1 255.255.255.0

crypto map outside_map

!

!

end

Show Outputs:

Site 1:

show crypto isakmp sa

IPv4 Crypto ISAKMP SA

          dst             src             state             conn-id slot      status

57.57.57.1      47.47.47.1      QM_IDLE           1014    0    ACTIVE

show crypto session detail

Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection

K - Keepalives, N - NAT-traversal, X - IKE Extended Authentication

F - IKE Fragmentation

Interface: FastEthernet0/0

Profile: testvpn

Session status: UP-IDLE

Peer: 57.57.57.1 port 500 fvrf: (none) ivrf: (none)

      Phase1_id: london.mydomain.com

      Desc: (none)

  IKE SA: local 47.47.47.1/500 remote 57.57.57.1/500 Active

          Capabilities:(none) connid:1014 lifetime:08:28:00

  IPSEC FLOW: permit ip 192.168.47.0/255.255.255.0 192.168.57.0/255.255.255.0

        Active SAs: 0, origin: crypto map

        Inbound:  #pkts dec'ed 23 drop 0 life (KB/Sec) 0/0

        Outbound: #pkts enc'ed 23 drop 31 life (KB/Sec) 0/0

Site 2:

show crypto isakmp sa

IPv4 Crypto ISAKMP SA

         dst             src             state              c   onn-id slot    status

57.57.57.1      47.47.47.1      QM_IDLE           1014    0    ACTIVE

show crypto session detail

Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection

K - Keepalives, N - NAT-traversal, X - IKE Extended Authentication

F - IKE Fragmentation

Interface: FastEthernet0/0

Profile: testvpn

Session status: UP-IDLE

Peer: 47.47.47.1 port 500 fvrf: (none) ivrf: (none)

      Phase1_id: india.mydomain.com

      Desc: (none)

  IKE SA: local 57.57.57.1/500 remote 47.47.47.1/500 Active

          Capabilities:(none) connid:1014 lifetime:08:26:22

  IPSEC FLOW: permit ip 192.168.57.0/255.255.255.0 192.168.47.0/255.255.255.0

        Active SAs: 0, origin: crypto map

        Inbound:  #pkts dec'ed 23 drop 0 life (KB/Sec) 0/0

        Outbound: #pkts enc'ed 23 drop 1 life (KB/Sec) 0/0

Debugs and runnig configurations are attached.

I hope this document was helpful

Thanks

Jeet Kumar

Version history
Revision #:
1 of 1
Last update:
‎09-27-2013 10:17 AM
Updated by:
 
Labels (1)
Attachments
Comments
New Member

Great configuration example & with complete illustration + debugs. much appreciated!

Silver

Great document!! It help alot !!!

New Member

Great document..very helpful

Cisco Employee

Top class! This document is to the point, detailed and very helpful. Kudos!