IKE Policy for Digital Certificates on an ES PIC

To obtain a signed certificate from the CA, issue the following command:

user@host> request security certificate enroll filename filename subject c=us,o=x alternative-subject certificate-ip-address certification-authority certificate-authority key-file key-file-name domain-name domain-name

The results are saved in a specified file to the /var/etc/ikecert directory.

The following example shows how to obtain a CA signed certificate by referencing the configured certification-authority statement local . This statement is referenced by the request security certificate enroll filename filename subject subject alternative-subject alternative-subject certification-authority certification-authority command.

[edit]
security {
    certificates {
        certification-authority local {
            ca-name xyz.company.com;
            file l;
            enrollment-url "http://www.xyzcompany.com";
        }
    }
}

To obtain a signed certificate from the CA, issue the following command:

user@host> request security certificate enroll filename I subject c=uk,o=london alternative-subject 10.50.1.4 certification-authority verisign key-file host-1.prv domain-name host.xyzcompany.com
CA name: xyz.company.com CA file: ca_verisign
local pub/private key pair: host.prv
subject: c=uk,o=london domain name: host.example.com
alternative subject: 10.50.1.4
Encoding: binary
Certificate enrollment has started. To see the certificate enrollment status, check the key management process (kmd) log file at /var/log/kmd. <-------------- 

For information about how to use the operational mode commands to obtain a signed certificate, see the CLI Explorer.

Another way to obtain a signed certificate from the CA is to reference the configured statements such as the URL, CA name, and CA certificate file by means of the certification-authority statement:

user@host> request security certificate enroll filename m subject c=us ,o=x alternative-subject 192.0.2.1 certification-authority local key-file y domain-name abc.company.com

Configuring the ES PIC associates the configured SA with a logical interface. This configuration defines the tunnel itself (logical subunit, tunnel addresses, maximum transmission unit [MTU], optional interface addresses, and the name of the SA to apply to traffic).

The addresses configured as the tunnel source and destination are the addresses in the outer IP header of the tunnel.

The SA must be a valid tunnel-mode SA. The interface address and destination address listed are optional. The destination address allows the user to configure a static route to encrypt traffic. If a static route uses that destination address as the next hop, traffic is forwarded through the portion of the tunnel in which encryption occurs.

The following example shows how to configure an IPsec tunnel as a logical interface on the ES PIC. The logical interface specifies the tunnel through which the encrypted traffic travels. The ipsec-sa statement associates the security profile with the interface.

[edit interfaces]
es-0/0/0 {
    unit 0 {
        tunnel {
            source tunnel 10.5.5.5;                      # tunnel source address
            destination 10.6.6.6;                          # tunnel destination address
        }
        family inet {
            ipsec-sa ipsec-sa; # name of security association to apply to packet
            address 10.1.1.8/32 { # local interface address inside local VPN
            destination 10.2.2.254; # destination address inside remote VPN
        }
    }
}