Can I use certificates/PKI to access a Cisco firewall?

[hoffa2000]

Hello folks

We've been discussing leveraging our PKI structure and firewall authentication and I'd like som input.

We have an internal CA structure built around the Microsoft service where we assign certificates and key chains to users in the domain. These certificates are then used to access different network and IT resources like WLAN and file shares. However the network infrastructure it self is still accessed using account name and password from a Radius server.

This is the best way I know of to secure the access to network devices but how about certificates? Some of our Linux servers authenticate users based on the private/public key used with SSH and I wounder if the same setup could be user with our Cisco equipment?

Regards

Fredrik Hofgren

[Eugene Khabarov · Accepted solution]

Hi! This functionallity was added in 15.0M branch. So now you can use rsa key chain authentication in IOS like on *nix boxes. Here is good article by Ivan Pepelnjak:

http://blog.ioshints.info/2009/10/ssh-rsa-authentication-works-in-ios.html

---

HTH. Please rate this post if it was helpful. If this solves your problem, please mark this post as "Correct Answer."

[hoffa2000]

Thank you for the tip, PKI on routers is a good start but still leaves the firewalls. At least it shows that Cisco is on the right track.

Regards

Fredrik