- last edited on by
Kelli Glass
With Prashanth Goutham R.
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about the Configuring, Troubleshooting & Best Practices on Adaptive Security Appliances (ASA) & Firewall Services Module (FWSM) Failover with Prashanth Goutham.
Firewall Services Module (FWSM) is a high-performance stateful-inspection firewall that integrates into the Cisco® 6500 switch and 7600 router chassis. The FWSM monitors traffic flows using application inspection engines to provide a strong level of network security. Cisco ASA protects networks of all sizes with MultiScale performance and a comprehensive suite of highly integrated, market-leading security services.
Prashanth Goutham is an experienced support engineer with the High Touch Technical Support (HTTS) Security team, covering all Cisco security technologies. During his four years with Cisco, he has worked with Cisco's major customers, troubleshooting routing, LAN switching, and security technologies. He is also qualified as a GIAC Certified Incident Handler (GCIH) by the SANS Institute.
Remember to use the rating system to let Prashanth know if you have received an adequate response.
Prashanth might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security sub-community forum shortly after the event. This event lasts through July 13, 2012. Visit this forum often to view responses to your questions and the questions of other community members.
Hello Roberto,
I tried out the configuration on 8.4.4 and observed the same issue as what you have noticed, look below :
CiscoASA(config-ca-trustpoint)# fqdn sslvpn.cisco.com
CiscoASA(config-ca-trustpoint)# subject-name CN=sslvpn.cisco.com
CiscoASA(config-ca-trustpoint)# crypto key generate rsa label sslvpnkeypair
INFO: The name for the keys will be: sslvpnkeypair
Keypair generation process begin. Please wait...
CiscoASA(config)# crypto ca trustpoint SELFSIGNEDCERT
CiscoASA(config-ca-trustpoint)# keypair sslvpnkeypair
CiscoASA(config)# crypto ca enroll SELFSIGNEDCERT noconfirm
% The fully-qualified domain name in the certificate will be: sslvpn.cisco.com
When i try to view it i see the below output on both Active and Standby Firewalls replicated without doing even a write standby:
CiscoASA(config)# show cry ca cert
Certificate
Status: Available
Certificate Serial Number: c5d1f44f
Certificate Usage: General Purpose
Public Key Type: RSA (1024 bits)
Signature Algorithm: SHA1 with RSA Encryption
Issuer Name:
hostname=sslvpn.cisco.com
cn=sslvpn.cisco.com
Subject Name:
hostname=sslvpn.cisco.com
cn=sslvpn.cisco.com
Validity Date:
start date: 16:29:09 GMT Jul 5 2012
end date: 16:29:09 GMT Jul 3 2022
Associated Trustpoints: SELFSIGNEDCERT
This is exactly matching the output you had provided, however what we both did not figure out earlier is that this is an Identity certificate and not a CA certificate. A typical CA certificate looks like this:
CiscoASA(config)# show crypto ca certificateCA Certificate
Status: Available
Certificate Serial Number: 344ed55720d5edec49f42fce37db2b6d
Certificate Usage: General Purpose
Public Key Type: RSA (2048 bits)
Signature Algorithm: SHA1 with RSA Encryption
Issuer Name:
cn=thawte Primary Root CA
ou=(c) 2006 thawte\, Inc. - For authorized use only
ou=Certification Services Division
o=thawte\, Inc.
c=US
Subject Name:
cn=thawte Primary Root CA
ou=(c) 2006 thawte\, Inc. - For authorized use only
ou=Certification Services Division
o=thawte\, Inc.
c=US
Validity Date:
start date: 00:00:00 UTC Nov 17 2006
end date: 23:59:59 UTC Jul 16 2036
Associated Trustpoints: abc
Hence going back to the document you had pointed out, its only speaking about the Local CA Generated certificates and not all locally generated Certificates (identity). Refer to the 8.4 Configuration guide as well which shows that the locally generated
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ha_active_standby.html
Note
Standby Failover does not replicate the following files and configuration components:
•
•
•
•
•
•
Hope that clarifies the document's wordings
