Configure Certificate Based Authentication for IKE: ISSUE Cert

dat.tran · ‎10-24-2014

Hi all,

I config IPSec betwen two PA device: 1 PA5020 and 1 PA

I generate CA on PA 5020 and import to PA 200

But on PA 200 i can't sign new Cert with the imported CA certificate.

I try generate all cert on PA 5020 ( root CA & signed CA) and import to PA 200.

But when config IKE gateaway, i can't chose CA

Something wrong, but i don't where

Pls help me

Thanks

bat · ‎10-24-2014

Could you please show us the snapshot of the CA imported ?

Also can you try generating the certificate to be used on PA-200 on PA-5020 itself ?

Hope it helps !

hyadavalli · ‎10-25-2014

Hello,

When you exported and imported certificate did you by any chance exported private key also?

Regards,

Hari Yadavalli

hshah · ‎10-25-2014

Hi Dat,

Make sure you have imported private key of the certificate along with certificate. If that is done for sure you sign another certificate.

Export certificate : make sure you click on private key and put passphrase. Exa; Passphrase is "test123"

Import Certificate : Make sure you click Import Private key. Put above specified passphrase "test123"

Regards,

Hardik Shah

dat.tran · ‎10-26-2014

Thanks for support,

now, i can import and used Cert

But, my tunnel IPSEC can't UP

I don't know what wrong.

Thanks.

My config:

PA 5020

PA 200

HULK · ‎10-26-2014

Hello dat.tran,

Could you please apply below mentioned CLI command to initiate the tunnel manually:

> test vpn ike-sa gateway XXXXXX

Initiate IKE SA: Total 1 gateways found. 1 ike sa found.

> test vpn ipsec-sa tunnel XXXXXX

Initiate IPSec SA: Total 1 tunnels found. 1 ipsec sa found.

After applying above CLI commands, i would request you to check MOnitor > Logs > System for more detail information (subtype= "vpn")

Hope this helps.

Thanks

dat.tran · ‎10-26-2014

Thanks, Time on PA 200 fault

Now, IPSEC tunnel is UP>

Thanks for your help :smileygrin: