Using Symantec SSL PKI to Authenticate Cisco IOS IPSec VPN – HA Deployment

Digital certificates as an authentication method for IPSec VPNs is becoming increasingly popular for both remote access and site-to-site deployments. The use of digital certificates requires some form of PKI infrastructure such as a CA server. In this post, Symantec public CA will be used as an example to authenticate certificates used between two IPSec VPN gateways. There are some other posts in this blog relating to this topics, please check them using following list:

• Using Symantec SSL PKI to Authenticate Cisco IOS IPSec VPN – HA Deployment
• Using PKI Build Route-Based IPSec VPN between Juniper SRX
• Certification based Cisco IPSec VPN Down caused by ‘signature invalid’
• Troubleshooting Symantec Verisign SSL Certificates Issue on PKI VPN Tunnel between Juniper SRX Firewalls (Cont.)
• Using Symantec Verisign SSL Certificate for Check Point SSL VPN Mobile Access Portal
• Using Symantec Verisign PKI to authenticate Checkpoint Site-to-Site IPSec VPN
• Cisco IKEv1 Site-to-Site IPSec Configuration on IOS Routers (2) – Using Two Different CA Certificates

This post is mainly used to document the steps how to built a Third Party Based Certificates IPSec VPN, including how to submit gateway’s CSR to Symantec and get your certs signed by Symantec CA and how to install those signed certs on your gateways. The first 8 steps are same for both for standalone deployment and high availability implementation. Only difference will be at step 9 for only used in high availability configuration.

Here are all steps:

1. Create RSA key:

M-16th#show crypto key mypubkey all % Key pair was generated at: 14:57:23 EDT Jul 24 2012 Key name: TP-self-signed-3560658343 Key type: RSA KEYS  Storage Device: private-config  Usage: General Purpose Key  Key is not exportable.  Key Data:   30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 0098EA03    0D5BD6B5 6EBDA599 28071B27 40A162FB 247927AB 3834F338 A36CE905 3E6A0AD2    BFB1F9CA BBF4E6A2 91C839B1 374CEA0F FEF63026 90AD641C 1674066F 2A7A92FF    3C28D56B 3E022446 B7CA5F1F DD9AD7A1 BFF96C6E 6B4F6F5A D1EE5541 3CDC0090    82B3545C 052A483C CB201EA4 50000035 5A15C29C 2B359EDA 7C5EE5C0 39020301 0001 % Key pair was generated at: 13:02:18 EST Dec 15 2014 Key name: TP-self-signed-3560658343.server Key type: RSA KEYS Temporary key  Usage: Encryption Key  Key is not exportable.  Key Data:   307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00DB7517 9CF9611C    AC80D3E6 69132768 9F5B0304 78B045FC F5A977F3 0526520C 64C60BA4 FCCA8C63    3DFC2552 36204A58 64F68227 5F3940E3 68287B47 1D9B1769 8E4AB4CD 7CDF21DD    0C43251F A36E956F 57A0769C A4395572 1111E008 46C09AE5 23020301 0001 % Key pair was generated at: 14:01:03 EST Dec 15 2014 Key name: M-16th.test.com Key type: RSA KEYS  Storage Device: private-config  Usage: General Purpose Key  Key is exportable.  Key Data:   30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101    00BD5C8B 863706DC E787D3CD 298E8DF9 00A7C9F6 49B4E0E2 76D1AC0C DEA184D2    8929AC9E 2A15A5E8 70A3898B 769CF6DA 60464B7D BB30A468 188AFE7E A747DA9F     C792D643 F2015AAE 9F991278 8BF16BE2 71020FE3 5275C651 A02B26B7 3D128FFE    7030567F 86029725 3711CF8B 76089C0E 1E607829 346BD5A2 4E0B3F2A B2618673    11020301 0001

2. Create Trustpoint on Your Routers

4. Submit CSR to Verisign and Retreive Signed Certificates

You may get a email with instruction where to download the intermediate / root CA certs.

Note: you may also get a different type email to ask you go on-line to download certificates. In that case, you may go through different steps as shown below:

Your download certificates package should include intermediateCA.cer, ssl_certificate.cer and some other getting_started documents.

5. Install Intermediate / Root Certificate(s)

If you did not get your Intermediate CA certificate from previous steps, you will need to go to Symantec Intermediate CA Certificates Web page to download it. You will see all kinds of different CA certificates for Symantec different SSL products. Choose one which is matching what you ordered. For this post, Secure Site is the right one.

6. Install actual Signed SSL Certificate on Cisco Router

Link1: Symantec Intermediate CA Certificates
Link2: Intermediate CA Certificates: Secure Site/Managed PKI for SSL Standard Certificates

Now it is the step to install the certs sent from Verisign by email. This certs is signed by Verisign based on CSR you submitted at step 4.

M-16th(config)#crypto pki import Verisign2014 certificate Enter the base 64 encoded certificate. End with a blank line or the word “quit” on a line by itself MIIFgTCCBGmgAwIBAgIQKjCOdOIFbDkbDAxmz+KJjANBgkqhkiG9w0BAQUFADCB tTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTsOQYDVQQLEzJUZXJtcyBvZiB1c2Ug YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY9tL3JwYSAoYykxMDEvMC0GA1UEAxMm VmVyaVNpZ24gQ2xhc3MgMyBTZWN1cgU2VydmVyIENBIC0gRzMwHhcNMTQwMzEw MDAwMDAwWhcNMTcwMzA5MjM1OT5WjCBuDELMAkGA1UEBhMCQ0ExEDAOBgNVBAgM B09udGFyaW8xEDAOBgNVBAcMB01hcmtoYW0xLzAtBgNVBAoMJkdpZXNlY2tlICYg hOfPbPdr7dX/ep5JELJUDaAl5AFiON75PYJBtUcrnYuduzqdpY51MV0lUXsa7GP 0kR0ngAfTotDmE76iV5Uno/FiJtVTTM0ZqidPWihJprmtNUjH8BnLO8jA3Kwqw qvKgAXbJnBOrYb7gGVlPC6r4LPhX7B6dwDaoRDpliSvGBpGAEx6POIW5tD8lvUW RCZisxlco3oFnxJj6V7hm17dzfnELz49Nisa4vcgfW9eI3Z+2gtM0fT5/oVGDKb 4zRQ+2tLUF72B1WlfFZ4YFl7/m7 % Failed to parse or verify imported certificate

The installation failed. The CA certificate imported at Step 5 could not verify this signed SSL certificate. It means the CA certificate is wrong one.

Based the TN 8530 – Why do I receive the error “Failed to parse or verify imported certificate” on a Cisco ASA?, this is the message to tell you the trustpoint certs you imported from previous step is a wrong one. To fix this error, you will have to delete whole trustpoint configuration by no command.

You will have to do step 2 and step 5 again to create a new trustpoint before you can import actual signed device SSL certificate using following command. As I mentioned before, I will have to use secondary Intermediate certs. After import secondary Intermediate CA certs into router as trustpoint, I were able to get right result as expected:

M-16th(config)#crypto pki import Verisign2014 certificate Enter the base 64 encoded certificate. End with a blank line or the word “quit” on a line by itself —–BEGIN CERTIFICATE—– MIIFgTCCBGmgAwIBAgIQKjCOdOIFbDkbDAxmz+KJjANBgkqhkiG9w0BAQUFADCB tTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTsOQYDVQQLEzJUZXJtcyBvZiB1c2Ug LmNvbS9TVlJTZWN1cmVHMy5jmwwQwYDVR0gBDwwOjA4BgpghkgBhvhFAQc2MCow KAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9jcHMwHQYDVR0l BBYwFAYIKwYBBQUHAwEGCCsAQUFBwMCMB8GA1UdIwQYMBaAFA1EXBZTRMGCfh0g qyX0AWPYvnmlMHYGCCsGAQUBwEBBGowaDAkBggrBgEFBQcwAYYYaHR0cDovL29j c3AudmVyaXNpZ24uY29tMEAGCsGAQUFBzAChjRodHRwOi8vU1ZSU2VjdXJlLUcz LWFpYS52ZXJpc2lnbi5jb20vU1ZS2VjdXJlRzMuY2VyMA0GCSqGSIb3DQEBBQUA A4IBAQCpZzArqkr+wlVsmCpgCe5MPMUw/SpQj0gV3zIv5oeMvDfpJN+olwhqJI hOfPbPdr7dX/ep5JELJUDaAl5AFiON75PYJBtUcrnYuduzqdpY51MV0lUXsa7GP 0kR0ngAfTotDmE76iV5Uno/FiJtVTTM0ZqidPWihJprmtNUjH8BnLO8jA3Kwqw qvKgAXbJnBOrYb7gGVlPC6r4LPhX7B6dwDaoRDpliSvGBpGAEx6POIW5tD8lvUW RCZisxlco3oFnxJj6V7hm17dzfnELz49Nisa4vcgfW9eI3Z+2gtM0fT5/oVGDKb 4zRQ+2tLUF72B1WlfFZ4YFl7/m7 —–END CERTIFICATE—– % Router Certificate successfully imported

7. Verify Certificates

M-16th#show crypto pki certificates Certificate   Status: Available   Certificate Serial Number (hex): 2A308E74E2056C391B0C0C769B3F8A26   Certificate Usage: General Purpose   Issuer:     cn=VeriSign Class 3 Secure Server CA – G3     ou=Terms of use at https://www.verisign.com/rpa (c)10     ou=VeriSign Trust Network     o=VeriSign      Inc.     c=US   Subject:     Name: M-16th.test.com     cn=M-16th.test.com     ou=Terms of use at www.verisign.com/rpa (c)05     o=Giesecke & Devrient systems canada inc     l=Markham     st=Ontario     c=CA   CRL Distribution Points:     http://SVRSecure-G3-crl.verisign.com/SVRSecureG3.crl   Validity Date:     start date: 20:00:00 EDT Mar 9 2014     end   date: 18:59:59 EST Mar 9 2017   Associated Trustpoints: Verisign2014 CA Certificate   Status: Available   Certificate Serial Number (hex): 6ECC7AA5A7032009B8CEBCF4E952D491   Certificate Usage: Signature   Issuer:     cn=VeriSign Class 3 Public Primary Certification Authority – G5     ou=(c) 2006 VeriSign      Inc. – For authorized use only     ou=VeriSign Trust Network     o=VeriSign      Inc.     c=US   Subject:     cn=VeriSign Class 3 Secure Server CA – G3     ou=Terms of use at https://www.verisign.com/rpa (c)10     ou=VeriSign Trust Network     o=VeriSign      Inc.     c=US   CRL Distribution Points:     http://crl.verisign.com/pca3-g5.crl   Validity Date:     start date: 19:00:00 EST Feb 7 2010     end   date: 18:59:59 EST Feb 7 2020   Associated Trustpoints: Verisign2014 Router Self-Signed Certificate   Status: Available   Certificate Serial Number (hex): 01   Certificate Usage: General Purpose   Issuer:     cn=IOS-Self-Signed-Certificate-3775191276   Subject:     Name: IOS-Self-Signed-Certificate-3775191276     cn=IOS-Self-Signed-Certificate-3775191276   Validity Date:     start date: 10:26:26 EST Jan 11 2012     end   date: 19:00:00 EST Dec 31 2019   Associated Trustpoints: TP-self-signed-3775191276   Storage: nvram:IOS-Self-Sig#1.cer M-16th#dir nvram: Directory of nvram:/   240  -rw-       10890                    <no date>  startup-config   241  —-        3921                    <no date>  private-config   242  -rw-       10890                    <no date>  underlying-config     1  -rw-        2945                    <no date>  cwmp_inventory     4  —-           0                    <no date>  rf_cold_starts     5  —-         117                    <no date>  persistent-data     6  -rw-         559                    <no date>  IOS-Self-Sig#1.cer     7  -rw-           0                    <no date>  ifIndex-table     8  -rw-        1413                    <no date>  VeriSignClas#8A26.cer    10  -rw-        1520                    <no date>  VeriSignClas#D491CA.cer

crypto pki trustpoint Verisign2014  enrollment terminal  fqdn 16th-M.test.com  subject-name CN=16th-M.test.com,OU=IT,O=xx,C=CA,ST=Ontario  revocation-check none  rsakeypair 16th-M.test.com ! ! crypto pki certificate chain Verisign2014  certificate 04681FB41D03897F3C61766E1DD5C42F   30820581 30820469 A0030201 02021004 681FB41D 03897F3C 61766E1D D5C42F30   0D06092A 864886F7 0D010105 05003081 B5310B30 09060355 04061302 55533117   30150603 55040A13 0E566572 69536967 6E2C2049 6E632E31 1F301D06 0355040B   13165665 72695369 676E2054 72757374 204E6574 776F726B 313B3039 06035504   0B133254 65726D73 206F6620 75736520 61742068 74747073 3A2F2F77 77772E76 ……   6C2527B9 DEB78458 C61F381E A4C4CB66         quit ! ! Policy 5 is using default RSA-SIG authentication method. crypto isakmp policy 5  encr 3des  hash md5  group 2 ! ! Policy 10 is using Pre-share key authentication method crypto isakmp policy 10  encr 3des  hash md5  authentication pre-share  group 2 ! crypto isakmp key PASSWORDWRONG address 10.9.8.1     crypto isakmp aggressive-mode disable ! crypto ipsec security-association idle-time 300 ! crypto ipsec transform-set Phase2 esp-3des esp-md5-hmac  mode tunnel ! ! ! crypto map VPN 10 ipsec-isakmp  set peer 10.9.8.1  no set security-association idle-time  set transform-set Phase2  match address protect ! ! ! ! interface GigabitEthernet0/1  ip address 10.9.8.2 255.255.255.200  ip flow ingress  duplex auto  speed auto  crypto map VPN ! ip access-list extended protect  permit ip 10.9.2.0 0.0.0.255 any  permit ip 10.9.6.0 0.0.0.255 any  permit ip 10.9.7.0 0.0.0.255 any  permit ip 10.9.3.0 0.0.0.255 any ! ! ! Router1#show crypto isakmp sa detail  Codes: C – IKE configuration mode, D – Dead Peer Detection        K – Keepalives, N – NAT-traversal        T – cTCP encapsulation, X – IKE Extended Authentication        psk – Preshared key, rsig – RSA signature        renc – RSA encryption IPv4 Crypto ISAKMP SA C-id  Local           Remote          I-VRF  Status Encr Hash   Auth DH Lifetime Cap. 9023  10.9.8.2      10.9.8.1             ACTIVE 3des md5    rsig 2  05:37:02            Engine-id:Conn-id =  SW:23 IPv6 Crypto ISAKMP SA Router1#

9. High Availability Configuration

9.1 Stateless Failover Configuration

interface GigabitEthernet0/0
 ip address 19.26.116.140 255.255.255.192
 standby 199 ip 19.26.116.141
 standby 199 preempt
 standby 199 name VPNHA
 standby 199 track 1 decrement 10
 duplex auto
 speed auto
 crypto map vpn redundancy VPNHA

9.2 Stateful Failover Configuration

redundancy inter-device
 scheme standby VPNHA

ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 19.26.116.139
    retransmit-timeout 300 10000
    path-retransmit 10
    assoc-retransmit 10
   remote-port 5000
    remote-ip 19.26.116.140
!

interface GigabitEthernet0/0
 ip address 19.26.116.139 255.255.255.192
 standby 199 ip 19.26.116.141
 standby 199 priority 105
 standby 199 preempt
 standby 199 name VPNHA
 standby 199 track 2 decrement 10
 duplex auto
 speed auto
 crypto map vpn redundancy VPNHA stateful

Notes: 

Some Other Useful Commands:

M-16th(config)#crypto pki export Verisign2014 pem terminal 3des cisco1234 % The specified trustpoint is not enrolled (VerisignCA1). % Only export the CA certificate in PEM format. % CA certificate: —–BEGIN CERTIFICATE—– MIIF7DCCBNSgAwIBAgIQbsx6pacDIAm4zrz06VLUkTANBgkqhkiG9w0BAQUFADCB yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0 KoZIhvcNAQEFBQADggEBAAyDJO/dwwzZWJz+NrbrioBL0aP3nfPMU++CnqOh5pfB WJ11bOAdG0z60cEtBcDqbrIicFXZIDNAMwfCZYP6j0M3m+oOmmxw7vacgDvZN/R6 bezQGH1JSsqZxxkoor7YdyT3hSaGbYcFQEFn0Sc67dxIHSLNCwuLvPSxe/20majp dirhGi2HbnTTiN0eIsbfFrYrghQKlFzyUOyvzv9iNw2tZdMGQVPtAhTItVgooazg W+yzf5VK+wPIrSbb5mZ4EkrZn0L74ZjmQoObj49nJOhhGbXdzbULJgWOw27EyHW4 Rs/iGAZeqa6ogZpHFt4MKGwlJ7net4RYxh84HqTEy2Y= —–END CERTIFICATE—– router#show crypto pki certificates router#show crypto key mypubkey rsa

Router(config)#crypto pki certificate validate Verisign2014 Chain has 2 certificates Certificate chain for Verisign2014 is valid

Reference:

• Installing GoDaddy SSL Certificates on a Cisco IOS Router using CLI
• Configuring High Availability Features for Site-to-Site IPSec VPNs
• Cisco High Availability Solution: Stateful Failover for IPsec