Lenovo Flex System Fabric CN4093, Application Manual

Page: 421 / 634

© Copyright Lenovo 2017 Chapter 25: Using IPsec with IPv6
421
Importing an IKEv2 Digital Certificate
To import an IKEv2 digital certificate for authentication:
1.
Import the CA certificate file.
2.
Import the host key file.
3.
Import the host certificate file.
Note:
When prompted for the port to use for download the file, if you used a
management port to connect the switch to the server, enter
mgt
, otherwise enter
data
.
Generating a Certificate Signing Request
Before a digital certificate can be signed by a Certificate Authority (CA), it needs to
be created. The generation of a certificate involves creating a Certificate Signing
Request (CSR). The CSR includes various information related to the device and a
public key. The public key is included in the CSR file itself and the private key
associated with the public key is generated separately and kept private. The CSR
can then be exported to a remote device to be signed by a CA.
1.
Create an HTTPS CSR defining the information you want to be used in the various
fields:
CN 4093(config)# copy tftp ca-cert address
<hostname or IPv4 address>
Source file name:
<path and filename of CA certificate file>
Port type ["DATA"/"MGT"]: >
Confirm download operation [y/n]:
y
CN 4093(config)# copy tftp host-key address
<hostname or IPv4 address>
Source file name:
<path and filename of host private key file>
Port type ["DATA"/"MGT"]: >
Confirm download operation [y/n]:
y
CN 4093(config)# copy tftp host-cert address
<hostname or IPv4 address>
Source file name:
<path and filename of host certificate file>
Port type ["DATA"/"MGT"]: >
Confirm download operation [y/n]:
y
CN 4093(config)# access https generate-csr
Country Name (2 letter code) []:
<country code>
State or Province Name (full name) []:
<state>
Locality Name (eg, city) []:
<city>
Organization Name (eg, company) []:
<company>
Organizational Unit Name (eg, section) []:
<org. unit>
Common Name (eg, YOUR name) []:
<name>
Email (eg, email address) []:
<email address>
Confirm Generate CSR? [y/n]: y
..............................................+++
..............+++
Cert Req generated successfully