Solved: How to specify the digital cert used in IKE phase 1 authentication

tonycarr69 · ‎05-04-2020

Hi All

We use PKI and Digital Certs for IPsec tunnels. Each box has three tunnels and three certs have been created as the original plan must have been to use a cert per tunnel. However I dont think this principle is working.

I need to understand if there is a way to specify a particular cert for authenitication on a tunnel. It appears that the IPsec profile can be references per tunnel, but this only covers the phase 2 negotiation. While the IKE phase 1 appears to use anything configured on the device, and the IKE Phase 1 config does not appear to have a command to specify a particular cert.

As we are moving to a new PKI infrastucture I want to sure I can control which cert is in use.

Thanks in advance.

Francesco Molino · ‎06-28-2020

Here an example of config working fine.

CERTIFICATE SPOKE:

SPOKE#sh cryp pki certificates
Certificate
  Status: Available
  Certificate Serial Number (hex): 7D000000F5C67031029CAEA3A10001000000F5
  Certificate Usage: General Purpose
  Issuer:
    cn=mydomainname-WINSRV-CA
    dc=mydomainname
    dc=com
  Subject:
    Name: spoke.mydomainname.com
    cn=SPOKE
    ou=TEST
    o=mydomainname
    hostname=spoke.mydomainname.com
  CRL Distribution Points:
    ldap:///CN=mydomainname-WINSRV-CA(1),CN=WINSRV,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=mydomainname,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint
    http://crl.mydomainname.com/crld/mydomainname-WINSRV-CA(1).crl
  Validity Date:
    start date: 04:21:06 EET Jun 29 2020
    end   date: 04:21:06 EET Jun 29 2022
  Associated Trustpoints: TEST
  Storage: nvram:mydomainname-W#F5.cer

CA Certificate
  Status: Available
  Certificate Serial Number (hex): 5A60DA43CF62528548F2CA5D71B8A3A1
  Certificate Usage: Signature
  Issuer:
    cn=mydomainname-WINSRV-CA
    dc=mydomainname
    dc=com
  Subject:
    cn=mydomainname-WINSRV-CA
    dc=mydomainname
    dc=com
  Validity Date:
    start date: 20:01:02 EET May 31 2020
    end   date: 20:11:02 EET Jun 1 2030
  Associated Trustpoints: TEST
  Storage: nvram:mydomainname-W#A3A1CA.cer

CERTIFICATE HUB:

HUB#sh crypto pki certificates
Certificate
  Status: Available
  Certificate Serial Number (hex): 7D000000F4A84BAA7D638C1A650001000000F4
  Certificate Usage: General Purpose
  Issuer:
    cn=mydomainname-WINSRV-CA
    dc=mydomainname
    dc=com
  Subject:
    Name: hub.mydomainname.com
    cn=hub
    ou=TEST
    o=mydomainname
    hostname=hub.mydomainname.com
  CRL Distribution Points:
    ldap:///CN=mydomainname-WINSRV-CA(1),CN=WINSRV,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=mydomainname,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint
    http://crl.mydomainname.com/crld/mydomainname-WINSRV-CA(1).crl
  Validity Date:
    start date: 04:20:37 EET Jun 29 2020
    end   date: 04:20:37 EET Jun 29 2022
  Associated Trustpoints: TEST
  Storage: nvram:mydomainname-W#F4.cer

CA Certificate
  Status: Available
  Certificate Serial Number (hex): 5A60DA43CF62528548F2CA5D71B8A3A1
  Certificate Usage: Signature
  Issuer:
    cn=mydomainname-WINSRV-CA
    dc=mydomainname
    dc=com
  Subject:
    cn=mydomainname-WINSRV-CA
    dc=mydomainname
    dc=com
  Validity Date:
    start date: 20:01:02 EET May 31 2020
    end   date: 20:11:02 EET Jun 1 2030
  Associated Trustpoints: TEST
  Storage: nvram:mydomainname-W#A3A1CA.cer

Crypto config on both devices (Hub and Spoke):

crypto pki trustpoint TEST
 enrollment terminal
 fqdn hub.mydomainname.com
 subject-name CN=hub,OU=TEST,O=mydomainname
 revocation-check none
 rsakeypair CERT
!
crypto pki certificate map CERT 10
 issuer-name co mydomainname-winsrv-ca
!
crypto isakmp policy 1
 encr aes
 group 5
!
crypto isakmp keepalive 30 periodic
crypto isakmp profile RED-MGMT-PROF
   ca trust-point TEST
   match certificate CERT
!
crypto ipsec transform-set RED-TS-1 esp-aes 256 esp-sha-hmac
 mode transport
!
crypto ipsec profile RED-PROFILE1
 set transform-set RED-TS-1
 set isakmp-profile RED-MGMT-PROF
!

For the Tunnel configuration, I kept your exact config.

Outputs HUB:

HUB#sh cryp isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
40.10.10.2      50.10.10.2      QM_IDLE           1004 ACTIVE

IPv6 Crypto ISAKMP SA

HUB#sh cryp ipsec sa

interface: Tunnel2
    Crypto map tag: Tunnel2-head-0, local addr 40.10.10.2

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (40.10.10.2/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (50.10.10.2/255.255.255.255/47/0)
   current_peer 50.10.10.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3
    #pkts decaps: 3, #pkts decrypt: 3, #pkts verify: 3
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 40.10.10.2, remote crypto endpt.: 50.10.10.2
     plaintext mtu 1458, path mtu 1500, ip mtu 1500, ip mtu idb (none)
     current outbound spi: 0xDF36BB57(3744906071)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xCBC61D43(3418758467)

HUB#sh dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
T1 - Route Installed, T2 - Nexthop-override
C - CTS Capable
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding, W --> Waiting
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================

Interface: Tunnel2, IPv4 NHRP Details
Type:Hub, NHRP Peers:1,

 # Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
 ----- --------------- --------------- ----- -------- -----
     1 50.10.10.2          100.96.20.2    UP 00:05:33     D

HUB#

Outputs Spoke:

SPOKE#sh cryp isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
40.10.10.2      50.10.10.2      QM_IDLE           1004 ACTIVE

IPv6 Crypto ISAKMP SA

SPOKE#sh cryp ipse sa

interface: Tunnel2
    Crypto map tag: Tunnel2-head-0, local addr 50.10.10.2

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (50.10.10.2/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (40.10.10.2/255.255.255.255/47/0)
   current_peer 40.10.10.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3
    #pkts decaps: 3, #pkts decrypt: 3, #pkts verify: 3
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 50.10.10.2, remote crypto endpt.: 40.10.10.2
     plaintext mtu 1458, path mtu 1500, ip mtu 1500, ip mtu idb (none)
     current outbound spi: 0xCBC61D43(3418758467)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xDF36BB57(3744906071)

SPOKE# sh dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
T1 - Route Installed, T2 - Nexthop-override
C - CTS Capable
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding, W --> Waiting
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================

Interface: Tunnel2, IPv4 NHRP Details
Type:Spoke, NHRP Peers:1,

 # Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
 ----- --------------- --------------- ----- -------- -----
     1 40.10.10.2          100.96.20.1    UP 00:06:04     S

SPOKE#

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

View solution in original post

Francesco Molino · ‎05-04-2020

Hi

If i got your question correctly, you can use certificate map to match a cert and attach it to your isakmp profile:
(https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ikevpn/configuration/xe-3s/sec-ike-for-ipsec-vpns-xe-3s-book/sec-cert-isakmp-map.html)

crypto pki certificate map certmap 10
subject-name co test.test.com
!
crypto isakmp policy 10
encryption aes
group 5
hash sha256
authentication rsa-sig
!
crypto isakmp profile PROF
ca trust-point subca
match certificate certmap

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

tonycarr69 · ‎05-05-2020

Thanks, this looks very promising. I will lab it up to test and let you know.

tonycarr69 · ‎06-16-2020

Hi Francesco

I tried the profile maps and my IPsec tunnel stopped working. I have pasted teh lab config below and the error messages when pinging from R1 (192.168.0.1) to R2 (192.168.0.2)

Each router's debug crypto ipsec output is also pasted below.

R1

hub#ping 192.168.0.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.0.2, timeout is 2 seconds:

Jun 16 16:51:39.807: [] -> [ACL ACL]: message ACL notify RP

Jun 16 16:51:39.807: [ACL ACL]: message = ACL notify RP

Jun 16 16:51:39.899: ISAKMP:(1001):deleting node 726610644 error TRUE reason "Delete Larval".

Jun 16 16:51:41.803: [] -> [ACL ACL]: message ACL notify RP

Jun 16 16:51:41.807: [ACL ACL]: message = ACL notify RP

Jun 16 16:51:41.807: IPSEC(MESSAGE): ipsec_isakmp_sa_initiate_internal not time to kick IKE.

Jun 16 16:51:43.803: [] -> [ACL ACL]: message ACL notify RP

Jun 16 16:51:43.807: [ACL ACL]: message = ACL notify RP

Jun 16 16:51:43.807: IPSEC(MESSAGE): ipsec_isakmp_sa_initiate_internal not time to kick IKE.

Jun 16 16:51:45.803: [] -> [ACL ACL]: message ACL notify RP

Jun 16 16:51:45.807: [ACL ACL]: message = ACL notify RP

Jun 16 16:51:45.807: IPSEC(MESSAGE): ipsec_isakmp_sa_initiate_internal not time to kick IKE.

Jun 16 16:51:47.803: [] -> [ACL ACL]: message ACL notify RP

Jun 16 16:51:47.807: [ACL ACL]: message = ACL notify RP

Jun 16 16:51:47.811: IPSEC(MESSAGE): ipsec_isakmp_sa_initiate_internal not time to kick IKE.

Success rate is 0 percent (0/5)

hub#

Jun 16 16:52:09.863: ISAKMP:(1001):deleting node -210817269 error TRUE reason "Delete Larval"

hub#

R2

remote-site#

Jun 14 10:17:54.587: map_db_check_isakmp_profile profile did not match

Jun 14 10:17:54.587: map_db_find_best did not find matching map

Jun 14 10:17:54.591: IPSEC(ipsec_process_proposal): proxy identities not supported

Jun 14 10:17:54.591: ISAKMP:(1001): IPSec policy invalidated proposal with error 32

Jun 14 10:17:54.595: ISAKMP:(1001): phase 2 SA policy not acceptable! (local 192.168.0.2 remote 192.168.0.1)

Jun 14 10:17:54.599: ISAKMP:(1001):deleting node -210817269 error TRUE reason "QM rejected"

remote-site#

#######################################
CONFIGS

R1

hub#sh run

Building configuration...

Current configuration : 5407 bytes

!

! Last configuration change at 16:23:16 UTC Tue Jun 16 2020

! NVRAM config last updated at 16:01:21 UTC Tue Jun 16 2020

upgrade fpd auto

version 15.2

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname hub

!

boot-start-marker

boot-end-marker

!

no aaa new-model

no ip icmp rate-limit unreachable

!

no ip domain lookup

ip domain name red.lcl

ip cef

no ipv6 cef

!

multilink bundle-name authenticated

!

crypto pki trustpoint RED-MGMT

enrollment terminal pem

fqdn hub.omni.cp-mgmt

subject-name C=GB,L=Reigate,O=<REDACTED>,OU=RED-MGMT,CN=HUB-SITE

revocation-check none

rsakeypair RED-MGMT

!

crypto pki trustpoint RED-PORTAL

enrollment terminal pem

fqdn hub.omni.cp-portal

subject-name C=GB,L=Reigate,O=<REDACTED>,OU=RED-PORTAL,CN=HUB-SITE-PORTAL

revocation-check none

rsakeypair RED-PORTAL

!

crypto pki certificate map RED-MGMT-MAP 10

subject-name co ou = red-mgmt

!

crypto pki certificate chain RED-MGMT

certificate 0323D6F4355DB034

3082023C 308201A5 A0030201 02020803 23D6F435 5DB03430 0D06092A 864886F7

0D01010B 0500304A 310B3009 06035504 06130247 42311830 16060355 040A130F

54727573 74697320 4C696D69 74656431 21301F06 0355040B 13185472 75737469

7320506C 6174696E 756D2052 6F6F7420 4341301E 170D3230 30363136 30393338

30305A17 0D323130 36313531 35333730 305A3077 3111300F 06035504 03130848

55422D53 49544531 11300F06 0355040B 13085245 442D4D47 4D54310F 300D0603

55040A13 06436170 69746131 10300E06 03550407 13075265 69676174 65310B30

09060355 04061302 4742311F 301D0609 2A864886 F70D0109 02161068 75622E6F

6D6E692E 63702D6D 676D7430 5C300D06 092A8648 86F70D01 01010500 034B0030

48024100 B49ED6A5 9EEE8E80 F9DFFF23 EFE37D93 C2BFBF59 9E3D6A07 2BE5640C

69F1A3E4 C0655F15 F1709A68 B39B4144 7D1C1382 4F296843 EBB9D3A1 B48F9019

910216E3 02030100 01A34230 40300B06 03551D0F 04040302 07803031 0603551D

25042A30 2806082B 06010505 07030506 082B0601 05050703 0606082B 06010505

07030706 082B0601 05050802 02300D06 092A8648 86F70D01 010B0500 03818100

4484B05E 4AACDAFF 210ECAC3 2DBA707B 78F6DDD1 68743BBF 2060D1EE 05E64895

F01BBE6B CD0C5F5C 683D6DC5 717BC665 1237A4D1 2556B836 415CFF81 15E74793

B5D31CAD 8C8B9D3F 07A58B12 DE83E83F 63DF096D B2BC3FA4 08D9A1E7 6A6BAECE

00A4F882 C03A4505 8C1E73B5 C5EBF3C4 425E47DC 446FA261 A3D7599E B111A5EE

quit

certificate ca 110ACA7BA6355951

3082022E 30820197 A0030201 02020811 0ACA7BA6 35595130 0D06092A 864886F7

0D01010B 0500304A 310B3009 06035504 06130247 42311830 16060355 040A130F

54727573 74697320 4C696D69 74656431 21301F06 0355040B 13185472 75737469

7320506C 6174696E 756D2052 6F6F7420 4341301E 170D3230 30363135 31353337

30305A17 0D323130 36313531 35333730 305A304A 310B3009 06035504 06130247

42311830 16060355 040A130F 54727573 74697320 4C696D69 74656431 21301F06

0355040B 13185472 75737469 7320506C 6174696E 756D2052 6F6F7420 43413081

9F300D06 092A8648 86F70D01 01010500 03818D00 30818902 818100BE A44B076D

23BFE546 392207CC 3BE59CC7 8DE275C3 0FFA9EA3 AF0D2476 9DF4FFF1 E5F5583D

69C1FE46 913458BB 06DDCE42 F2E6E966 1426269E 7B2E2ABA 866E7018 40D771B0

00DDCAAD DF058D46 650FA691 9D7A5C83 4113372D 32E7BAC9 5594671B 93917E10

92141AB8 20B77DD2 121FF0EE 77547ACD 2D9193E9 8E5D6634 BDE23902 03010001

A31D301B 300C0603 551D1304 05300301 01FF300B 0603551D 0F040403 02028C30

0D06092A 864886F7 0D01010B 05000381 8100635F 0BEBE03B 0FE1697C 446DC1E5

18F3CC4D C0C05BF0 0D828FE9 23D8EA3F 9C5CC249 EBACAF3A A319B91A A28B66C4

54871AE8 EB2FAE2C 4ADFC26F 9F519387 DFA9D387 0B4B0DFB 4CACD4B5 E21A9914

36BA096B E015DA34 24799F7D 09F7F545 82B8142E CEDF1356 421C4B77 BAF9A8FC

C18D0D1A 0770A04C 4F8AD750 0571BB34 42F1

quit

certificate ca 110ACA7BA6355951

quit

crypto pki certificate chain RED-PORTAL

!

redundancy

!

ip tcp synwait-time 5

ip ssh version 1

!

crypto isakmp policy 10

encr 3des

hash md5

crypto isakmp profile RED-MGMT-PROFILE

match identity address 192.168.0.2 255.255.255.255

match certificate RED-MGMT-MAP

!

crypto ipsec transform-set TS esp-3des esp-md5-hmac

mode tunnel

!

crypto map CRYPTO 10 ipsec-isakmp

set peer 192.168.0.2

set transform-set TS

set isakmp-profile RED-MGMT-PROFILE

match address ACL

!

interface Loopback0

ip address 10.1.1.1 255.255.255.0

!

interface FastEthernet0/0

description to R2

ip address 192.168.0.1 255.255.255.252

duplex auto

speed auto

crypto map CRYPTO

!

interface FastEthernet0/1

no ip address

shutdown

duplex auto

speed auto

!

interface Serial1/0

no ip address

shutdown

serial restart-delay 0

!

interface Serial1/1

no ip address

shutdown

serial restart-delay 0

!

interface Serial1/2

no ip address

shutdown

serial restart-delay 0

!

interface Serial1/3

no ip address

shutdown

serial restart-delay 0

!

ip forward-protocol nd

no ip http server

no ip http secure-server

!

ip route 10.2.2.0 255.255.255.0 192.168.0.2

!

ip access-list extended ACL

permit ip host 192.168.0.1 host 192.168.0.2

!

no cdp log mismatch duplex

!

control-plane

!

mgcp profile default

!

gatekeeper

shutdown

!

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line vty 0 4

login

transport input all

!

end

#######################################

R2

Building configuration...

Current configuration : 5507 bytes

!

! Last configuration change at 09:48:24 UTC Sun Jun 14 2020

! NVRAM config last updated at 09:27:14 UTC Sun Jun 14 2020

upgrade fpd auto

version 15.2

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname remote-site

!

boot-start-marker

boot-end-marker

!

no aaa new-model

no ip icmp rate-limit unreachable

!

no ip domain lookup

ip domain name red.lcl

ip cef

no ipv6 cef

!

multilink bundle-name authenticated

!

crypto pki trustpoint RED-MGMT

enrollment terminal pem

fqdn remote.nwp.lcl

subject-name C=GB,L=Newcastle,O=<REDACTED>,OU=RED-MGMT,CN=Remote-Site

revocation-check none

rsakeypair RED-MGMT

!

crypto pki trustpoint RED-PORTAL

enrollment terminal pem

fqdn remote.nwp.lcl.portal

subject-name C=GB,L=Newcastle,O=<REDACTED>,OU=RED-PORTAL,CN=Remote-Site-Portal

revocation-check none

rsakeypair RED-PORTAL

!

crypto pki certificate map RED-MGMT-MAP 10

subject-name co ou = red-mgmt

!

crypto pki certificate chain RED-MGMT

certificate 14A29E9132480516

3082024C 308201B5 A0030201 02020814 A29E9132 48051630 0D06092A 864886F7

0D01010B 0500304A 310B3009 06035504 06130247 42311830 16060355 040A130F

54727573 74697320 4C696D69 74656431 21301F06 0355040B 13185472 75737469

7320506C 6174696E 756D2052 6F6F7420 4341301E 170D3230 30363136 30393434

30305A17 0D323130 36313531 35333730 305A3081 86311430 12060355 0403130B

52656D6F 74652D53 69746531 11300F06 0355040B 13085245 442D4D47 4D54311B

30190603 55040A13 124E6F72 7468756D 62726961 20506F6C 69636531 12301006

03550407 13094E65 77636173 746C6531 0B300906 03550406 13024742 311D301B

06092A86 4886F70D 01090216 0E72656D 6F74652E 6E77702E 6C636C30 5C300D06

092A8648 86F70D01 01010500 034B0030 48024100 C7C60495 AF151BA7 70AD6555

4141A4DB 16443942 500019F7 C50DBD58 5F75ACD2 5391CEB5 25EE6541 EA945AD7

444D2B5C 5C64D898 82F10890 ED230667 335146A5 02030100 01A34230 40300B06

03551D0F 04040302 07803031 0603551D 25042A30 2806082B 06010505 07030506

082B0601 05050703 0606082B 06010505 07030706 082B0601 05050802 02300D06

092A8648 86F70D01 010B0500 03818100 1FCBEB4E 7ECFB519 0B0DC486 E12D5290

BF981A63 FEFA4A37 36531084 26B0A56D 5B5F9E7B 88260091 8A6B0143 84212A53

CA8F2EDD 56DBA385 0F42D699 D8395228 5879E531 3AB1415A 31E607D6 0EA8842B

9311ABE6 22C204EE A5877583 2F7C3DFA 666BB69A 229D86CB EA4B888A A173F90D

3BA4716D C7D7681E 96CB41FC 63BFA24C