Network Security Memorandum

Monday, September 16, 2013

Cisco IOS IPSec VPN with External Trusted PKI Certs - Verisign

Topology:

using IOU Rack v3 from post

My Cisco IOU Racks - from flyxj IOUv3

It looks like following screenshot:

The goal is to achieve ipsec with third party trusted PKI certs - verisign. This lab will use verisign trial version to demonstrate procedures.

Enabled R6 and R7 as PC to do testing. Logical topology looks like following:

1. Delete all existing configuration then reload those four routers:

R2#delete nvram:startup-config
Delete filename [startup-config]?
Delete nvram:startup-config? [confirm]
[OK]
R2#reload

2. Make vpn up using pre-share key:

@R1
crypto isakmp policy 10
authentication pre-share
group 2
crypto isakmp key cisco1234 address 10.94.200.47
!
crypto ipsec transform-set VPN1 ah-sha-hmac esp-3des esp-sha-hmac
!
crypto map VPN-MAP 10 ipsec-isakmp
set peer 10.94.200.47
set transform-set VPN1
match address ACL-VPN
!
interface Ethernet0/0
ip address 10.94.200.37 255.255.255.0
crypto map VPN-MAP

ip route 0.0.0.0 0.0.0.0 10.94.200.37
ip access-list extended ACL-VPN
permit ip 192.168.177.0 0.0.0.255 192.168.99.0 0.0.0.255

@R2:
crypto isakmp policy 10
authentication pre-share
group 2
crypto isakmp key cisco1234 address 10.94.200.37
!
crypto ipsec transform-set VPN1 ah-sha-hmac esp-3des esp-sha-hmac
!
crypto map VPN-MAP 10 ipsec-isakmp
set peer 10.94.200.37
set transform-set VPN1
match address ACL-VPN
!
interface Ethernet0/0
ip address 10.94.200.47 255.255.255.0
crypto map VPN-MAP
ip route 0.0.0.0 0.0.0.0 10.94.200.37
!
ip access-list extended ACL-VPN
permit ip 192.168.99.0 0.0.0.255 192.168.177.0 0.0.0.255

Test Result by ping R7's ip 192.168.99.1 from R6
R6#ping 192.168.99.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.99.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/8/12 ms

Debug Crypto Isakmp Output @R1:

R1(config)#
*Mar 11 02:14:55.159: ISAKMP:(0): SA request profile is (NULL)
*Mar 11 02:14:55.159: ISAKMP: Created a peer struct for 10.94.200.47, peer port 500
*Mar 11 02:14:55.159: ISAKMP: New peer created peer = 0xB6803C58 peer_handle = 0x80000002
*Mar 11 02:14:55.159: ISAKMP: Locking peer struct 0xB6803C58, refcount 1 for isakmp_initiator
*Mar 11 02:14:55.159: ISAKMP: local port 500, remote port 500
*Mar 11 02:14:55.159: ISAKMP: set new node 0 to QM_IDLE
*Mar 11 02:14:55.159: ISAKMP:(0):insert sa successfully sa = B6803240
*Mar 11 02:14:55.159: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
*Mar 11 02:14:55.159: ISAKMP:(0):found peer pre-shared key matching 10.94.200.47
*Mar 11 02:14:55.159: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
*Mar 11 02:14:55.159: ISAKMP:(0): constructed NAT-T vendor-07 ID
*Mar 11 02:14:55.159: ISAKMP:(0): constructed NAT-T vendor-03 ID
*Mar 11 02:14:55.159: ISAKMP:(0): constructed NAT-T vendor-02 ID
*Mar 11 02:14:55.159: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
*Mar 11 02:14:55.159: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1

*Mar 11 02:14:55.159: ISAKMP:(0): beginning Main Mode exchange
*Mar 11 02:14:55.159: ISAKMP:(0): sending packet to 10.94.200.47 my_port 500 peer_port 500 (I) MM_NO_STATE
*Mar 11 02:14:55.159: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Mar 11 02:14:55.163: ISAKMP (0): received packet from 10.94.200.47 dport 500 sport 500 Global (I) MM_NO_STATE
*Mar 11 02:14:55.163: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Mar 11 02:14:55.163: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM2

*Mar 11 02:14:55.183: ISAKMP:(0): processing SA payload. message ID = 0
*Mar 11 02:14:55.183: ISAKMP:(0): processing vendor id payload
*Mar 11 02:14:55.183: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
*Mar 11 02:14:55.183: ISAKMP (0): vendor ID is NAT-T RFC 3947
*Mar 11 02:14:55.183: ISAKMP:(0):found peer pre-shared key matching 10.94.200.47
*Mar 11 02:14:55.183: ISAKMP:(0): local preshared key found
*Mar 11 02:14:55.183: ISAKMP : Scanning profiles for xauth ...
*Mar 11 02:14:55.183: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
*Mar 11 02:14:55.183: ISAKMP: encryption DES-CBC
*Mar 11 02:14:55.183: ISAKMP: hash SHA
*Mar 11 02:14:55.183: ISAKMP: default group 2
*Mar 11 02:14:55.183: ISAKMP: auth pre-share
*Mar 11 02:14:55.183: ISAKMP: life type in seconds
*Mar 11 02:14:55.183: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
*Mar 11 02:14:55.183: ISAKMP:(0):atts are acceptable. Next payload is 0
*Mar 11 02:14:55.183: ISAKMP:(0):Acceptable atts:actual life: 0
*Mar 11 02:14:55.183: ISAKMP:(0):Acceptable atts:life: 0
*Mar 11 02:14:55.183: ISAKMP:(0):Fill atts in sa vpi_length:4
*Mar 11 02:14:55.183: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
*Mar 11 02:14:55.183: ISAKMP:(0):Returning Actual lifetime: 86400
*Mar 11 02:14:55.183: ISAKMP:(0)::Started lifetime timer: 86400.

*Mar 11 02:14:55.183: ISAKMP:(0): processing vendor id payload
*Mar 11 02:14:55.183: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
*Mar 11 02:14:55.183: ISAKMP (0): vendor ID is NAT-T RFC 3947
*Mar 11 02:14:55.183: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Mar 11 02:14:55.183: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM2

*Mar 11 02:14:55.183: ISAKMP:(0): sending packet to 10.94.200.47 my_port 500 peer_port 500 (I) MM_SA_SETUP
*Mar 11 02:14:55.183: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Mar 11 02:14:55.183: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Mar 11 02:14:55.183: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM3

*Mar 11 02:14:55.191: ISAKMP (0): received packet from 10.94.200.47 dport 500 sport 500 Global (I) MM_SA_SETUP
*Mar 11 02:14:55.191: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Mar 11 02:14:55.191: ISAKMP:(0):Old State = IKE_I_MM3 New State = IKE_I_MM4

*Mar 11 02:14:55.191: ISAKMP:(0): processing KE payload. message ID = 0
*Mar 11 02:14:55.195: ISAKMP:(0): processing NONCE payload. message ID = 0
*Mar 11 02:14:55.195: ISAKMP:(0):found peer pre-shared key matching 10.94.200.47
*Mar 11 02:14:55.195: ISAKMP:(1001): processing vendor id payload
*Mar 11 02:14:55.195: ISAKMP:(1001): vendor ID is Unity
*Mar 11 02:14:55.195: ISAKMP:(1001): processing vendor id payload
*Mar 11 02:14:55.195: ISAKMP:(1001): vendor ID is DPD
*Mar 11 02:14:55.195: ISAKMP:(1001): processing vendor id payload
*Mar 11 02:14:55.195: ISAKMP:(1001): speaking to another IOS box!
*Mar 11 02:14:55.195: ISAKMP:received payload type 20
*Mar 11 02:14:55.195: ISAKMP (1001): His hash no match - this node outside NAT
*Mar 11 02:14:55.195: ISAKMP:received payload type 20
*Mar 11 02:14:55.195: ISAKMP (1001): No NAT Found for self or peer
*Mar 11 02:14:55.195: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Mar 11 02:14:55.195: ISAKMP:(1001):Old State = IKE_I_MM4 New State = IKE_I_MM4

*Mar 11 02:14:55.199: ISAKMP:(1001):Send initial contact
*Mar 11 02:14:55.199: ISAKMP:(1001):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
*Mar 11 02:14:55.199: ISAKMP (1001): ID payload
next-payload : 8
type : 1
address : 10.94.200.37
protocol : 17
port : 500
length : 12
*Mar 11 02:14:55.199: ISAKMP:(1001):Total payload length: 12
*Mar 11 02:14:55.199: ISAKMP:(1001): sending packet to 10.94.200.47 my_port 500 peer_port 500 (I) MM_KEY_EXCH
*Mar 11 02:14:55.199: ISAKMP:(1001):Sending an IKE IPv4 Packet.
*Mar 11 02:14:55.199: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Mar 11 02:14:55.199: ISAKMP:(1001):Old State = IKE_I_MM4 New State = IKE_I_MM5

*Mar 11 02:14:55.199: ISAKMP (1001): received packet from 10.94.200.47 dport 500 sport 500 Global (I) MM_KEY_EXCH
*Mar 11 02:14:55.199: ISAKMP:(1001): processing ID payload. message ID = 0
*Mar 11 02:14:55.199: ISAKMP (1001): ID payload
next-payload : 8
type : 1
address : 10.94.200.47
protocol : 17
port : 500
length : 12
*Mar 11 02:14:55.199: ISAKMP:(0):: peer matches *none* of the profiles
*Mar 11 02:14:55.199: ISAKMP:(1001): processing HASH payload. message ID = 0
*Mar 11 02:14:55.199: ISAKMP:(1001):SA authentication status:
authenticated
*Mar 11 02:14:55.199: ISAKMP:(1001):SA has been authenticated with 10.94.200.47
*Mar 11 02:14:55.199: ISAKMP: Trying to insert a peer 10.94.200.37/10.94.200.47/500/, and inserted successfully B6803C58.
*Mar 11 02:14:55.199: ISAKMP:(1001):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Mar 11 02:14:55.199: ISAKMP:(1001):Old State = IKE_I_MM5 New State = IKE_I_MM6

*Mar 11 02:14:55.199: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Mar 11 02:14:55.199: ISAKMP:(1001):Old State = IKE_I_MM6 New State = IKE_I_MM6

*Mar 11 02:14:55.203: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Mar 11 02:14:55.203: ISAKMP:(1001):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE

*Mar 11 02:14:55.203: ISAKMP:(1001):beginning Quick Mode exchange, M-ID of 1780039293
*Mar 11 02:14:55.203: ISAKMP:(1001):QM Initiator gets spi
*Mar 11 02:14:55.203: ISAKMP:(1001): sending packet to 10.94.200.47 my_port 500 peer_port 500 (I) QM_IDLE
*Mar 11 02:14:55.203: ISAKMP:(1001):Sending an IKE IPv4 Packet.
*Mar 11 02:14:55.203: ISAKMP:(1001):Node 1780039293, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
*Mar 11 02:14:55.203: ISAKMP:(1001):Old State = IKE_QM_READY New State = IKE_QM_I_QM1
*Mar 11 02:14:55.203: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
*Mar 11 02:14:55.203: ISAKMP:(1001):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE

*Mar 11 02:14:55.207: ISAKMP (1001): received packet from 10.94.200.47 dport 500 sport 500 Global (I) QM_IDLE
*Mar 11 02:14:55.207: ISAKMP:(1001): processing HASH payload. message ID = 1780039293
*Mar 11 02:14:55.207: ISAKMP:(1001): processing SA payload. message ID = 1780039293
*Mar 11 02:14:55.207: ISAKMP:(1001):Checking IPSec proposal 1
*Mar 11 02:14:55.207: ISAKMP: transform 1, AH_SHA
*Mar 11 02:14:55.207: ISAKMP: attributes in transform:
*Mar 11 02:14:55.207: ISAKMP: encaps is 1 (Tunnel)
*Mar 11 02:14:55.207: ISAKMP: SA life type in seconds
*Mar 11 02:14:55.207: ISAKMP: SA life duration (basic) of 3600
*Mar 11 02:14:55.207: ISAKMP: SA life type in kilobytes
*Mar 11 02:14:55.207: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
*Mar 11 02:14:55.207: ISAKMP: authenticator is HMAC-SHA
*Mar 11 02:14:55.207: ISAKMP:(1001):atts are acceptable.
*Mar 11 02:14:55.207: ISAKMP:(1001):Checking IPSec proposal 1
*Mar 11 02:14:55.207: ISAKMP: transform 1, ESP_3DES
*Mar 11 02:14:55.207: ISAKMP: attributes in transform:
*Mar 11 02:14:55.207: ISAKMP: encaps is 1 (Tunnel)
*Mar 11 02:14:55.207: ISAKMP: SA life type in seconds
*Mar 11 02:14:55.207: ISAKMP: SA life duration (basic) of 3600
*Mar 11 02:14:55.207: ISAKMP: SA life type in kilobytes
*Mar 11 02:14:55.207: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
*Mar 11 02:14:55.207: ISAKMP: authenticator is HMAC-SHA
*Mar 11 02:14:55.207: ISAKMP:(1001):atts are acceptable.
*Mar 11 02:14:55.207: ISAKMP:(1001): processing NONCE payload. message ID = 1780039293
*Mar 11 02:14:55.207: ISAKMP:(1001): processing ID payload. message ID = 1780039293
*Mar 11 02:14:55.207: ISAKMP:(1001): processing ID payload. message ID = 1780039293
*Mar 11 02:14:55.207: ISAKMP:(1001): Creating IPSec SAs
*Mar 11 02:14:55.207: inbound SA from 10.94.200.47 to 10.94.200.37 (f/i) 0/ 0
(proxy 192.168.99.0 to 192.168.177.0)
*Mar 11 02:14:55.207: has spi 0xA14845AE and conn_id 0
*Mar 11 02:14:55.207: lifetime of 3600 seconds
*Mar 11 02:14:55.207: lifetime of 4608000 kilobytes
*Mar 11 02:14:55.207: outbound SA from 10.94.200.37 to 10.94.200.47 (f/i) 0/0
(proxy 192.168.177.0 to 192.168.99.0)
*Mar 11 02:14:55.207: has spi 0x85C87ECF and conn_id 0
*Mar 11 02:14:55.207: lifetime of 3600 seconds
*Mar 11 02:14:55.207: lifetime of 4608000 kilobytes
*Mar 11 02:14:55.207: ISAKMP:(1001): Creating IPSec SAs
*Mar 11 02:14:55.207: inbound SA from 10.94.200.47 to 10.94.200.37 (f/i) 0/ 0
(proxy 192.168.99.0 to 192.168.177.0)
*Mar 11 02:14:55.207: has spi 0x87C3AC12 and conn_id 0
*Mar 11 02:14:55.207: lifetime of 3600 seconds
*Mar 11 02:14:55.207: lifetime of 4608000 kilobytes
*Mar 11 02:14:55.207: outbound SA from 10.94.200.37 to 10.94.200.47 (f/i) 0/0
(proxy 192.168.177.0 to 192.168.99.0)
*Mar 11 02:14:55.207: has spi 0xFD71F9A9 and conn_id 0
*Mar 11 02:14:55.207: lifetime of 3600 seconds
*Mar 11 02:14:55.207: lifetime of 4608000 kilobytes
*Mar 11 02:14:55.207: ISAKMP:(1001): sending packet to 10.94.200.47 my_port 500 peer_port 500 (I) QM_IDLE
*Mar 11 02:14:55.207: ISAKMP:(1001):Sending an IKE IPv4 Packet.
*Mar 11 02:14:55.207: ISAKMP:(1001):deleting node 1780039293 error FALSE reason "No Error"
*Mar 11 02:14:55.207: ISAKMP:(1001):Node 1780039293, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
R1(config)#
*Mar 11 02:14:55.207: ISAKMP:(1001):Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE

3. Next step is to install Certifications from Verisign Trial Site based on the steps on my previous post:

Install Verisign SSL Certificates on a Cisco ISO Router

@R1 and @R2

crypto isakmp policy 5
group 2

4. Last Step is to do testing:

clear crypto sa

16th-Markham#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
10.94.200.37 10.94.200.47 QM_IDLE 9031 ACTIVE

16th-Markham#show crypto isakmp sa detail
Codes: C - IKE configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal
T - cTCP encapsulation, X - IKE Extended Authentication
psk - Preshared key, rsig - RSA signature
renc - RSA encryption
IPv4 Crypto ISAKMP SA

C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap.

10.94.200.37 10.94.200.47 ACTIVE des sha rsig 2 23:56:03
Engine-id:Conn-id = SW:31

5. Notes:

a. We should note that ISAKMP Phase 1 policy is defined globally. This means that if we have five different remote sites and configured five different ISAKMP Phase 1 policies (one for each remote router), when our router tries to negotiate a VPN tunnel with each site it will send all five policies and use the first match that is accepted by both ends.

b. If your router does not have Internet Access to fetch CRL list, you will have to put following command into your trustpoint:
revocation-check none

c. Debug Commands

show crypto session
clear crypto sa
show crypto pki certificate

Thursday, September 12, 2013

Using Symantec Verisign PKI to authenticate Checkpoint Site-to-Site IPSec VPN

This lab will use Symantec Verisign Trial SSL Certificate and Checkpoint R76 installed on VMware to demonstrate the steps how to use external OPSEC PKI to authenticate IPSec VPN Tunnel

Topology:

The goal is to ping from 192.168.177.1 to 192.168.99.1 with RSA signature authentication method.

1. Create a VPN community
Create a VPN community for both firewalls without use external trusted third party PKI. Since both firewalls are managed by same management server, they will automatically use internal.ca to do authentication.
a. Create a VPN community with default settings. Add both firewalls cpmodule (vpn1) and cp_2 (vpn2) into participating gateways list.

b. Confirm they will use any of its certificate.

c. Create firewall rules
Those rules allow traffic encrypted to pass through vpn tunnel

d. verify by ping from one end to another end.

2. Import Symantec Verisign Trial Root CA and Intermediate CA certificates
a. Download both CA certificates from website URL:
https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id=AR1738

you will find link for both CA certificates:

b. Add them into servers tab:

3. Create CSR on both firewalls.
a. Add a new certificate, then select verisigntrialinternediate as enroll source. Click generate to generate CSR. Use view to check CSR and save it to a file.

DN: CN=vpn.yourdomain.com,O=Your Company,L=City,ST=Ontario,C=CA
note: ST has to be full name of province. You can not use ON to replace Ontario

4. Submit CSR to Get your Signed Certificates
Go to Verisign free trail web page to apply the certificate with CSR you just saved.
https://trustcenter.websecurity.symantec.com/process/retail/trial_product_selector?uid=d6f070aaef900487ba6bf0edafdaa23c&locale=VRSN_US&language=en
It will expire in 30 days, but should be enough for a lab to prove your concept.

At final step , it will notify you the order number and tell you a email will send to you with approved certificate in it. It may take 8 hours to delivery it.
Also you always can check status of your order at http://www.verisign.com/status
you can check if you request has been approved or not, also if certificate issued.

5. Complete your CSR request and import certificates into your firewall.

Click complete on your firewall IPsec VPN tab. Select the file which Verisign sent to you in the email.

6. Change firewall authentication method to use Verisign CA PKI.
Do it on both firewalls.

7. Push firewall policy on both firewalls.
Use ping to do test and check logs from Smartview Tracker. It will still have CRL retrieval error. After fixed that, you should be able to see traffic going through tunnel without problem.

Reference:

How To Install Third Party SSL Certificates for the IPsec VPN Software Blade

Wednesday, September 11, 2013

TekRADIUS Usage for AD Authentication

TekRADIUS is a RADIUS software which can be easily integrated with AD. I have tested on one of pc , which even it is not in the domain. But AD authentication is still working, but not with group property.
Here are some configuration settings:

I set up two groups. One is admin group with privilege 15. Another is admin-read group.

Authentication-Method, I select Active Directory with server ip 10.94.16.242.

Clients is default, which means any. Secret is cisco.

Please make sure Vendor ID 42214 kaplansoft is in this dictionary editor. The version I download from website is not including this. I requested it from the discussion board.

Authentication port is set to 1812 and Accounting port is 1645. debug logging is for troubleshooting, although not too much info in there.

Configuration on the Radius Clients:
1. Checkpoint SmartDashboard: host_mgmt_1 is the RADIUS server ip address.

Create a new administrator with exactly same name as your AD account. Of course please choose authentication method as RADIUS.

2. Juniper NSM:

Similar as checkpoint configuration. Create a new authentication nserver then add a same ad name account with Remote authenticated.

Tuesday, September 10, 2013

PKI Basic Flow Chart

PKI = Public Key Infrastructure（公钥基础设施）

基础设施：

就是一个普适性基础，它在一个大环境里起着基本框架的作用，，设施基本原理共通，操作简便，只要遵循基本原则，不同的实体就可以方便地使用基础设施提供的服务。

公钥基础设施：

用非对称密码算法原理和技术是实现并提供安全服务的具有通用性的安全基础设施。

公钥证书：

用户的身份与之所持有的公钥的结合，在结合之前，由一个可信任的权威机构——认证机构（CA）来证实用户的身份。然后由可信任的CA对该用户身份及对应公钥相结合的证书进行数字签名，用来证明证书的有效性。

一个PKI系统主要包括：

认证机构，证书库，密钥备份及恢复系统，证书撤销处理系统，PKI应用接口系统。

PKI主要包括四个部分：

X.509格式证书，证书注销列表CRL；

CA/RA操作协议；

CA管理协议；

CA政策制定。

密钥对产生的两种方式：

用户自己产生密钥对，然后将公钥以安全方式传给CA，该过程应保证用户公钥的可检验性和完整性（验证身份的密钥对应先产生）

CA替用户产生密钥对，然后将其以安全方式传送给用户，必须保证密钥的机密性，完整性和可检验性。该方式下由于用户的私钥为CA所产生，故对CA的可信性有更高的要求。

证书签发两种方式：

离线方式发放：面对面发放，用于企业级高级证书的发放；

在线方式发放：通过Internet使用LDAP(Lightweight Directory Access Protocol )，在i500目录服务器上下载证书。

LDAP：http://www.microsoft.com/china/technet/prodtechnol/exchange/2003/insider/ldapquery.mspx

离线方式发放：

批准注册---->

RA（审核授权部门）在LDAP目录服务器中添加企业证书申请人的有关信息----->

RA将申请人信息传给CA----->

CA产生一个参照号（一次性密钥）和一个认证码（也称user ID和Password），以电子邮件，或打印在保密信封中传给申请者----->

申请者输入参照号级认证密码，在RA面对面领取证书（存在软盘或IC卡等介质中）。

在线方式发放：

个人证书申请者将个人信息写入CA的申请人信息数据库中------>

RA端接收从CA端发放的参照号和认证码，并打印出来，交给申请人----->

证书申请人回到自己的计算机上，登陆网站，通过浏览器安装Root CA证书------>

申请人在网页上按提示填入参照号和授权号，自助式地下载自己的证书

下图给出了PKI认证和加密数据的基本流图：

传送过程：

A要给B 发送“我们的五年计划是····”的明文，将不定长的明文用摘要算法计算后变为定长的的摘要，然后用认证私钥对摘要进行签名，再将明文和签名后的摘要用相应的对称密钥（用B的加密公钥对对称密钥进行加密传输）进行加密变为密文。

接收过程：

B用自己的加密私钥对对称密钥解密，用得到的对称密钥对密文进行解密，用A的公钥对摘要进行认证，通过认证后，对明文以同样的摘要算法进行摘要计算，如果得到的摘要与A传送过来的摘要一致，则说明明文正确。

Friday, August 30, 2013

NSM Shows License Validation Exception even with new license added in.

SRX license expired yesterday, log into support site and renewed new license and added it into SRX. But NSM still shows 'Attack/Detector Update License Validation Exception'

-------------------------------------------------------------------------------------------------
On SRX Device, system shows license has been added:
admin@FW-SRX-1> show system license
License usage:
Licenses Licenses Licenses Expiry
Feature name used installed needed
idp-sig 0 1 0 2014-08-29 20:00:00 EDT
dynamic-vpn 0 2 0 permanent
ax411-wlan-ap 0 2 0 permanent
logical-system 0 1 0 permanent

Licenses installed:
License identifier: JUNOS100000
License version: 2
Valid for device: AG4511AA0000
Features:
idp-sig - IDP Signature
date-based, 2013-08-29 20:00:00 EDT - 2014-08-29 20:00:00 EDT

At NSM, try to update device attack database:

NSM shows license validation exception error:

Solution:

Reboot NSM.

Pages