PIX / IPSEC / VPN3000 Client & Certificates - another catchy title!

[maddog32]

Hi,

I'm trying to configure a PIX 515, IOS v6.0(1), as the terminate point for an IPSEC tunnel from a VPN3000 Client using Certificates supplied by a Microsoft Certificate Authority Server for authentication.

Over the last few days I've been banging my head against walls and now resorting to asking the community if you could provide me with an example configuration for the PIX, VPN3000 client and Certification Server.

Surely, someone out there is using this combination and will be able to provide me with example configs!!!!

Your help will be greatly appreciated and probably save me from any longterm mental problems resulting from not having to bang my head against any more walls!!!! ;-)

Cheers,
Maddog

 

[asafayan]

I configured a Windows 2000 server as our internal CA. With a Microsoft provided add-on that I installed , I was able to configure the VPN concentrator and the VPN clients to request certs via SCEP (simple certificate enrollment protocol). SCEP is a Cisco protocol to streamline the certfication process. Basically, as long as the VPN Concentrator and/or VPN client have IP connectivity to the CA box, the installation of the certs is very easy.

So for remote users, you can punch a hole in a firewall that says something like: permit tcp any host ( IP address of CA) eq http and remote users would be able to request CA signed digital certificates via SCEP.

This is the only practical way clients can scale remote VPN access.

The following articles were used in the configuration:
Microsoft SCEP Add-On

http://www.wedgetail.com/upki/1.2/RELNOTES.html

Configuring Microsoft Certificate Services

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csvpnc/csvpnsg/idcmsft.htm

Configuring the Cisco VPN Concentrator to get a Digital Certificate with SCEP

http://www.cisco.com/warp/public/471/vpn3k_scep.html

Configuring the Cisco VPN Client to get a Digital Certificate

http://www.cisco.com/warp/public/471/installmscert.html

Configuring the Cisco VPN Concentrator to Communicate with the VPN Client using Certificates

http://www.cisco.com/warp/customer/471/installboth.html

Regards