Belden Hirschmann OWL LTE M12, User Manual

Page: 79 / 153

Configuration 4.10 IPsec Tunnel Configuration
Continued from previous page
Item Description
Local Certificate
\
PubKey
Certificate for X.509 authentication or PubKey for public key sig-
nature authentication.
Local Private Key Private key for X.509 authentication.
Local Passphrase Passphrase used during private key generation.
Debug Choose the level of verbosity to System Log. Silent (default),
audit, control, control-more, raw, private (most verbose includ-
ing the private keys). See strongSwan documentation for more
details.
Table 35: IPsec Tunnel Configuration
Do not miss:
•
If local and remote subnets are not configured then only packets between local and
remote IP address are encapsulated, so only communication between two routers is
encrypted.
• If protocol/port fields are configured then only packets matching these settings are
encapsulated.
The following procedure describes how to generate certificates and keys without a password
phrase:
******************** certification authority ************************
openssl rand -out private/.rand 1024
openssl genrsa -des3 -out private/ca.key 2048
openssl req -new -key private/ca.key -out tmp/myrootca.req
openssl x509 -req -days 7305 -sha1 -extensions v3_ca -signkey
private/ca.key -in tmp/myrootca.req -out ca.crt
******************** server cert *************************************
openssl genrsa -out private/server.key 2048
openssl req -new -key private/server.key -out tmp/server.req
openssl x509 -req -days 7305 -sha1 -extensions v3_req -CA ca.crt -CAkey
private/ca.key -in tmp/server.req -CAserial ca.srl -CAcreateserial
-out server.crt
******************** client cert **************************************
openssl genrsa -out private/client.key 2048
openssl req -new -key private/client.key -out tmp/client.req
openssl x509 -req -days 7305 -sha1 -extensions v3_req -CA ca.crt -CAkey
private/ca.key -in tmp/client.req -CAserial ca.srl -CAcreateserial
-out client.crt
Listed below are the certificates with password phrase "router" (certification authority remains
unchanged):
78
UM Configuration OWL LTE M12
Rel. 06.1.09 - 07/2019