PING Cisco Setup

PING setzt fürs Routing der IP-Daten Cisco-Router ein.

SSH-Key

conf t
CR1(config)#crypto key generate rsa label cr1.ping.de modulus 2048
The name for the keys will be: cr1.ping.de

% The key modulus size is 2048 bits
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 9 seconds)

IPSec-Tunnel

1. Erzeugen eines RSA-Keys:

   openssl genrsa -out cr1_ping_de.pem 2048

2. Erzeugen eines CSR (Certificate Sign Request):

   openssl req -config openssl.cnf -new -key private/cr1_ping_de.pem -out req/cr1_ping_de.pem

3. Erzeugen des Zertifikates:

   openssl ca -config openssl.cnf -in req/cr1_ping_de.pem -out certs/cr1_ping_de.pem

4. PKCS#12 Paket für die Cisco zusammenschrauben:

   openssl pkcs12 -inkey private/cr1_ping_de.pem -in certs/cr1_ping_de.pem -certfile cacert.pem -export -out private/cr1pingde.p12

5. PKCS#12 Paket auf Cisco laden:

   TTY514@CR1 #copy scp://dh@83.97.42.2/cr1pingde.p12 flash:

6. PKCS#12 importieren:

   conf t
   CR1(config)#no crypto pki trustpoint pingnetca
   CR1(config)#crypto pki import pingnetca pkcs12 flash:cr1pingde.p12 password <passwort>
   CR1(config)# crypto pki trustpoint pingnetca
   CR1(ca-trustpoint)#usage ike
   CR1(ca-trustpoint)#revocation-check none

Links: http://www.sans.org/rr/whitepapers/vpns/753.php