VPN l2l certificate authentication

[Tony JOrdan]

Hi everyone,

I just wanted to clarify some of the crypto requirements for setting up a l2l vpn.

1. Trustpoint - doeas a trustpoint need only contain an identity / general certificate or is a CA certiifcate required as well ?

2 Trustpoint - does the CA and identity / general certificates have to belong to the same trustpoint reference.

3 Trustpoint - where are the public and private keys stored on flash ?

For the pki to work must the devices configured with certs be able to reach the CA server?

Cheers

Tony

[GioGonza]

Hello @Tony JOrdan,

Here are the responses: 

1. Trustpoint - doeas a trustpoint need only contain an identity / general certificate or is a CA certiifcate required as well?

If you are going to install the certificate on a Cisco ASA or Router, you need to have the all chain installed (this includes the Root, Intermidiate and Identity). As you are going to do Site to Site you need to install additionally the Root and/or Intermidiate in order to validate the same. 

2 Trustpoint - does the CA and identity / general certificates have to belong to the same trustpoint reference.

The trustpoints are for the Identity certificates and each is like this 1 trustpoint = 1 identity. The CA are another kind of trustpoint but you don´t create them. 

3 Trustpoint - where are the public and private keys stored on flash ?

They are stored on the NVRAM.

4 For the pki to work must the devices configured with certs be able to reach the CA server?

No, as I said before you need to install the chain for your certificate and the chain for the remote end. 

HTH

Gio

[Tony JOrdan]

 Hi GioGonza,

thanks very much for the explanations 

just to be clearer on the CA certificates side of things.

In the configuration the CA cert would have to be associated to a trustpoint yes ?

As the CA cert could be associated to a different trustpoint, would that still work ?

Cheers

Tony

[GioGonza]

Hello @Tony JOrdan,

In the configuration the CA cert would have to be associated to a trustpoint yes ?

It depends, if you have a Root Certificate --> Identity >> the associated trustpoint will appear on the Root.

if you have a Root --> Intermediate --> Identity >> the associated trustpoint will appear on the Intermediate and not on the Root. 

As the CA cert could be associated to a different trustpoint, would that still work ?

Yes, the CA cert is on the configuration to validate Identity certificates, so when you receive the connection it will use the CA for validation and it will on all the CA certificates database (it doesn´t matter which truspoint is associated)

HTH

Gio