Lab 17.2 IPSEC VPN site-to-site chứng thực qua CA 2k8

ASA1(config)#[COLOR=#ff0000] crypto ca authenticate CA[/COLOR]


INFO: Certificate has the following attributes:
Fingerprint:     6c68062d 92188438 fc44cd32 918bda27
Do you accept this certificate? [yes/no]: [COLOR=#ff0000]yes[/COLOR]

[COLOR=#ff0000]Trustpoint CA certificate accepted.[/COLOR]

ASA1(config)# [COLOR=#ff0000]crypto ca enroll CA[/COLOR]
%
% Start certificate enrollment ..
% Create a challenge password. You will need to verbally provide this
   password to the CA Administrator in order to revoke your certificate.
   For security reasons your password will not be saved in the configuration.
   Please make a note of it.
[COLOR=#ff0000]Password: ****************  [/COLOR][I][COLOR=#00ff00]// điền password enrollment challenge mà bạn đã lấy được ở trên[/COLOR][/I]
[COLOR=#ff0000]Re-enter password: ****************[/COLOR]


% The subject name in the certificate will be: cn=svuit O=svuit ou=svuit e=svuit.com


% The fully-qualified domain name in the certificate will be: ASA1.svuit.com


% Include the device serial number in the subject name? [yes/no]: [COLOR=#ff0000]no[/COLOR]


Request certificate from CA? [yes/no]: [COLOR=#ff0000]yes[/COLOR]
[COLOR=#ff0000]% Certificate request sent to Certificate Authority[/COLOR]

ASA2(config)# [COLOR=#ff0000]crypto ca authenticate CA[/COLOR]


INFO: Certificate has the following attributes:
Fingerprint:     6c68062d 92188438 fc44cd32 918bda27
Do you accept this certificate? [yes/no]: [COLOR=#ff0000]yes[/COLOR]


Trustpoint CA certificate accepted.

ASA2(config)# [COLOR=#ff0000]crypto ca enroll CA[/COLOR]
%
% Start certificate enrollment ..
% Create a challenge password. You will need to verbally provide this
   password to the CA Administrator in order to revoke your certificate.
   For security reasons your password will not be saved in the configuration.
   Please make a note of it.
[COLOR=#ff0000]Password: ****************[/COLOR] [I][COLOR=#00ff00]//password này khác với password ở trên, bạn thực hiện lấy pass giống như ở trên[/COLOR][/I]
Re-enter password: ****************


% The subject name in the certificate will be: cn=svuit O=svuit ou=svuit e=svuit.com


% The fully-qualified domain name in the certificate will be: ASA2.svuit.com


% Include the device serial number in the subject name? [yes/no]: [COLOR=#ff0000]no[/COLOR]


Request certificate from CA? [yes/no]: [COLOR=#ff0000]yes[/COLOR]
% Certificate request sent to Certificate Authority
ASA1(config)# [COLOR=#ff0000]The certificate has been granted by CA![/COLOR]

ASA1# sh crypto ca certificates CA
Certificate
  Status: Available
  Certificate Serial Number: 6126fc29000000000004
  Certificate Usage: General Purpose
  Public Key Type: RSA (1024 bits)
  Signature Algorithm: SHA1 with RSA Encryption
  Issuer Name:
    cn=WIN-A1BNMMHMO2S-CA
  Subject Name:
    cn=svuit O\=svuit ou\=svuit e\=svuit.com
    hostname=ASA1.svuit.com
  CRL Distribution Points:
    [1]  file://WIN-A1BNMMHMO2S/CertEnroll/WIN-A1BNMMHMO2S-CA.crl
  Validity Date:
    start date: 09:26:23 UTC Jul 25 2014
    end   date: 09:36:23 UTC Jul 25 2015
  Associated Trustpoints: CA


CA Certificate
  Status: Available
  Certificate Serial Number: 0ade7cdd23724fa742db353bc233fb52
  Certificate Usage: Signature
  Public Key Type: RSA (2048 bits)
  Signature Algorithm: SHA1 with RSA Encryption
  Issuer Name:
    cn=WIN-A1BNMMHMO2S-CA
  Subject Name:
    cn=WIN-A1BNMMHMO2S-CA
  Validity Date:
    start date: 06:17:25 UTC Jul 5 2014
    end   date: 06:27:24 UTC Jul 5 2019
  Associated Trustpoints: CA

ASA1# sh crypto ikev1 sa


IKEv1 SAs:


   Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1


1   IKE Peer: 152.2.2.2
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE

ASA1# sh crypto ipsec sa
interface: outside
    Crypto map tag: ASA-VPN, seq num: 10, local addr: 151.1.1.1


      access-list VPN-TRAFFIC extended permit ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.20.0/255.255.255.0/0/0)
      current_peer: 152.2.2.2


      #pkts encaps: 14, #pkts encrypt: 14, #pkts digest: 14
      #pkts decaps: 14, #pkts decrypt: 14, #pkts verify: 14
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 14, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0


      local crypto endpt.: 151.1.1.1/0, remote crypto endpt.: 152.2.2.2/0
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: C2505B2E
      current inbound spi : 0C8FFEE8


    inbound esp sas:
      spi: 0x0C8FFEE8 (210763496)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 8192, crypto-map: ASA-VPN
         sa timing: remaining key lifetime (kB/sec): (3914999/28713)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00007FFF
    outbound esp sas:
      spi: 0xC2505B2E (3260046126)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 8192, crypto-map: ASA-VPN
         sa timing: remaining key lifetime (kB/sec): (3914999/28713)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001