topic Re: Configure Certificate Based Authentication for IKE: ISSUE Cert in General Topics

Configure Certificate Based Authentication for IKE: ISSUE Cert

dat.tran — Sat, 25 Oct 2014 03:31:25 GMT

Hi all,

I config IPSec betwen two PA device: 1 PA5020 and 1 PA

I config as guide: How to Configure Certificate Based Authentication for IKE on PAN-OS 6.0

I generate CA on PA 5020 and import to PA 200

But on PA 200 i can't sign new Cert with the imported CA certificate.

I try generate all cert on PA 5020 ( root CA & signed CA) and import to PA 200.

But when config IKE gateaway, i can't chose CA

Something wrong, but i don't where

Pls help me

Thanks

Re: Configure Certificate Based Authentication for IKE: ISSUE Cert

bat — Sat, 25 Oct 2014 03:52:30 GMT

Hi dat.tran

Could you please show us the snapshot of the CA imported ?

Also can you try generating the certificate to be used on PA-200 on PA-5020 itself ?

Hope it helps !

Re: Configure Certificate Based Authentication for IKE: ISSUE Cert

hyadavalli — Sat, 25 Oct 2014 13:16:32 GMT

Hello,

When you exported and imported certificate did you by any chance exported private key also?

Regards,

Hari Yadavalli

Re: Configure Certificate Based Authentication for IKE: ISSUE Cert

hshah — Sat, 25 Oct 2014 14:12:15 GMT

Hi Dat,

Make sure you have imported private key of the certificate along with certificate. If that is done for sure you sign another certificate.

Export certificate : make sure you click on private key and put passphrase. Exa; Passphrase is "test123"

Import Certificate : Make sure you click Import Private key. Put above specified passphrase "test123"

Regards,

Hardik Shah

Re: Configure Certificate Based Authentication for IKE: ISSUE Cert

dat.tran — Mon, 27 Oct 2014 03:30:21 GMT

Thanks for support,

now, i can import and used Cert

But, my tunnel IPSEC can't UP

I don't know what wrong.

Thanks.

My config:

PA 5020

PA 200

Re: Configure Certificate Based Authentication for IKE: ISSUE Cert

HULK — Mon, 27 Oct 2014 03:36:01 GMT

Hello dat.tran,

Could you please apply below mentioned CLI command to initiate the tunnel manually:

> test vpn ike-sa gateway XXXXXX

Initiate IKE SA: Total 1 gateways found. 1 ike sa found.

> test vpn ipsec-sa tunnel XXXXXX

Initiate IPSec SA: Total 1 tunnels found. 1 ipsec sa found.

After applying above CLI commands, i would request you to check MOnitor > Logs > System for more detail information (subtype= "vpn")

Hope this helps.

Thanks

Re: Configure Certificate Based Authentication for IKE: ISSUE Cert

dat.tran — Mon, 27 Oct 2014 04:10:22 GMT

Thanks, Time on PA 200 fault

Now, IPSEC tunnel is UP>

Thanks for your help :smileygrin: