2

Is is possible to setup site to site ipsec tunnel on two ASA with certificate authentication without available certificate authority for both ASA. As per guide from: Cisco site Certificate authority is required. Anyone could help with some materials, guides etc? Business need is to eliminate PSK.

diagram

Improve this question
12
  • 1
    But you must be able to validate the certificates. The certificates do expire, too.
    – Ron Maupin ♦
    Feb 2, 2017 at 15:06
  • 1
    OK, you have me confused. If you don't have access to the CA, then you cannot validate the certificates. Are you saying that this tunnel is not over the public Internet, so the ASAs don't have access to the CAs on the public Internet?
    – Ron Maupin ♦
    Feb 2, 2017 at 15:16
  • 1
    But how do you contact the root CA? That should be on the public Internet. Why do you need a VPN if it is not crossing the public Internet?
    – Ron Maupin ♦
    Feb 2, 2017 at 15:27
  • 1
    The ASAs need to be able to validate the certificates, hence the need for the CA. You can't simply trust a certificate, it must be validated to have trust.
    – Ron Maupin ♦
    Feb 2, 2017 at 15:49
  • 1
    You have the option for pre-shared key, certificate, or challenge/response. The purpose is to trust the other side, and you need some method of doing that, otherwise, any other device could come in and say it is valid, too. With certificates, you have a third-party (CA) telling the devices that the other side can be trusted.
    – Ron Maupin ♦
    Feb 2, 2017 at 15:55

1 Answer 1

Reset to default
3

From the comments I understand that you mean you have a CA, it's just not reachable by the VPN peers. (If you do not have a CA at all, things are different). As you mention yourself in the comments, installing the CA certificate on each side is enough to be able to valide the peer's certificate, and access to the CA is only required if you want to do revocation checking (i.e. download the CRL).

There are multiple ways to solve this:

1) If you control the CA, you can configure it to push the CRL out to a separate HTTP server that is accessible from the VPN peers, and include that server's URL as the CDP in the certificates.

2) If you control the CA, you can configure it to issue certificates without a CDP.

3) On the VPN peers, you can configure "crl nocheck" under the CA trustpoint.

Obviously, solution 1 would be the most secure as it still allows revocation checking.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.