Alcatel-Lucent OmniAccess 700, Cli Configuration Manual

Page: 784 / 1193

IP Security - Virtual Private Network
Left running head:
Chapter name (automatic)
758
Beta Beta
CLI Configuration Guide
Alcatel-Lucent
T
O
C
ONFIGURE A
S
TRICT
CRL P
OLICY
By default, the OA-700 has a lenient CRL policy, i.e., even if the CRL is not
present (not imported) or expired, the peer's certificate will be accepted. There is
an option of making this CRL policy strict.
E
XAMPLE
ALU(config)# crypto crl-check strict
ALU(config)# no crypto crl-check strict
T
O
I
MPORT A
P
EER
’
S
S
ELF
-
SIGNED
C
ERTIFICATE
The peer’s self-signed certificate can be imported to override the CA check. This
can be done if the peer is not enrolled with any of the trusted CAs and if the peer
is trusted. Thus one does not have to rely on the certificate to be transmitted by
the peer as part of the IKE protocol.
E
XAMPLE
ALU(config)# crypto peer-certificate cert_Bouvier import ftp:
Command (in CM) Description
crypto crl-check strict
This command makes the CRL policy
strict.
It ensures that if no CRL is present or if
the CRL is already expired, then no
negotiation takes place until a new CRL
is imported.
no crypto crl-check strict
This command makes the CRL policy
lenient.
Command (in CM) Description
crypto peer-certificate <name>
import [ fpkey <file-path>
| ftp: | tftp: | http: | https: | scp: ]
This command imports trusted peer
certificates in the OA-700.
Note: Currently, SCP option is not
supported.