AudioCodes Mediant 500L MSBR, Configuration Manual

Page: 40 / 74

Mediant MSBRs 40 Document #: LTRT-31828
Security Setup
7.1.3 Configuring IPSec with RSA
It is possible to use certificates instead of pre-shared password for authentication. The device
provides its own Trusted Root Certificate store. This store lets you manage trusted CA
certificates to authenticate the remote side. You can import up to 20 certificates to the store
(this amount might be less depending on certificate file size).
This storage can also be used for trusted certificate chains. A certificate chain is a sequence
of certificates where each certificate in the chain is signed by the subsequent certificate. The
last certificate in the list of certificates is the Root CA certificate, which is self-signed. The
purpose of a certificate chain is to establish a chain of trust from a child certificate to the
trusted root CA certificate. The CA vouches for the identity of the child certificate by signing
upon it. A client certificate is considered trusted if one of the CA certificates in the certificate
chain is present in the server certificate directory. For the device to trust a whole chain of
certificates, all of them must be imported.
Figure 7-4: Configuring IPSec Using RSA
Each certificate in the file must be Base64 encoded (PEM). When copying-and-pasting the
certificates to the device, each Base64 ASCII encoded certificate string must be enclosed
between " -----BEGIN CERTIFICATE----- " and " -----END CERTIFICATE----- ".
You must configure the device clock settings, preferably with an NTP server, to make sure
that the expiration date for the certificates are correctly validated.
For the IPSEC to authenticate using PKI, the CA certificate or CA chain certificates need to
be imported to the device. A certificate signing request (CSR) needs to be first generated
and then the signed certificate needs to be imported to the device. In the generation of the
signing request, a private key is used. The private key needs to be generated or imported
prior to the signing request. Using this signing request, the CA generates a certificate that
can then be imported to the device.
This "MSBR certificate" is later used to establish an IPSec connection.
7.1.3.1 Importing Certificates
This procedure describes how to import certificates.
7.1.3.1.1 Private Key
A private key needs to be generated or imported. The private key is used to generate
enrollment requests to the CA. To generate a private key, use the following command:
(config-isakmp-pki)# private-key generate 2048
Generating new 2048-bit private key, this might take some time...
New 2048-bit private key generated.
(config-isakmp-pki)#