3Com MSR 50 Series, Configuration Manual

Page: 1844 / 2443

1844 C
HAPTER
97: PKI C
ONFIGURATION
Applying RSA Digital
Signature in IKE
Negotiation
Network requirements
■
An IPSec tunnel is set up between Router A and Router B to secure the data
streams between Host A on the subnet 10.1.1.0/24 and Host B on the subnet
11.1.1.0/24.
■
Router A and Router B use IKE for IPSec tunnel negotiation and RSA digital
signature of a PKI certificate system for identify authentication.
■
As shown in Figure 534 , Router A and Router B have different CAs. They may
use the same CA as required.
Network diagram
Figure 534 Diagram for applying RSA digital signature in IKE negotiation
Configuration procedure
1
Configure Router A
# Configure the entity name space.
<RouterA> system-view
[RouterA] pki entity en
[RouterA-pki-entity-en] ip 2.2.2.1
[RouterA-pki-entity-en] common-name routerA
[RouterA-pki-entity-en] quit
# Configure the PKI domain. Note that the URL of the enrollment server varies by
the CA server.
Internet
RA 1
1.1.1.100/32
LDAP 1
1.1.1 .102 /32
CA 1
1.1.1.101/32
RA 2
2.1.1.100/32
LDAP 2
2.1.1 .102 /32
CA 2
2.1.1.101 /32
PKI certificate system
Router A Router B
Host A
Host B
S2/0
2.2 .2.1/24
S2/0
3.3 .3.1/24
Eth1/0
10 .1.1.1/24
Eth1/0
11.1.1.1/24
10.1 .1.2/24 11 .1.1.2/24