Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 403 / 861

402 Providing remote access using VPN tunnels
Authenticating tunnels using Entrust certificates
Authenticating tunnels using Entrust certificates
Entrust certificates can be used for IKE authentication with gateway-to-gateway VPN tunnels and
client-to-gateway VPN tunnels.
Note: If you plan to enable IKE and select Certificate as your authentication method, you must first
configure the system to use X.509 V3 certificates. If you select Certificate without going through the
proper setup procedure, your IKE daemon will shut down rather than proceed with dynamic
negotiations.
This setup process involves generating files using the Entrust server (acting as the certificate authority
- CA) and then using the raptcert utility on the security gateway to complete the process.
Prerequisites
■
You must have an Entrust server installed and be familiar with its use.
■
The Entrust server and the security gateway must be in the same network and able to communicate
with each other.
Generating the certificate on the security gateway
Although the certificate is generated on the security gateway, you must initiate the process on the
Entrust CA server. This is a two-step process:
■
Create the entrust.ini and username.epf files
■
Generate the certificate
To create the entrust.ini and username.epf files on the Entrust CA server
1 To create a new user, use the Entrust Admin utility, accessible from Start > Programs > Entrust >
Entrust Admin.
Once this user is created, two values are displayed in the Entrust Server window:
■
A reference number, for example, 77115029.
■
An authorization code, for example, PWEJ-GIEB-AIBE3.
3 global_ike_policy global_ike_policy Global IKE policy. Spaces are not permitted in the name.
4 local_entity engineering_subnet Name of the local endpoint for the secure tunnel. This
must be a host, subnet, or group entity.
5 local_entity_type ENT_SUBNET Must be ENT_HOST, ENT_SUBNET, or ENT_USERGROUP.
6 local_security_gateway local_gateway Name of the local security gateway network entity for the
tunnel.
7 remote_entity jsmith Name of the remote endpoint for the secure tunnel. This
must be a user or user group network entity.
8 remote_entity_type ENT_USER Must be ENT_USER or ENT_USERGROUP.
9 filters sample_dos_filter You may add optional filters here, enclosed in braces {}.
The filters listed here must be created using the SGMI. If a
filter is specified, a VPN policy that applies the filter is
created. If more than one filter is listed, a filter group is
added and then assigned to the VPN policy. The filter
group use the filters in the order they appear in the list.
Table 10-2
pkimpvpn file format (Continued)
Field Field name Example Description