Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения

Страница: 1266 / 2086

48-12
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 48 Configuring MACsec Encryption
Understanding MKA MACsec with EAP-TLS
•
MKA supports encryption using AES-GCM-128 encryption only and does not support Security
Group Tagging.
Understanding Certificate Enrollment
Certificate enrollment is the process of obtaining a certificate from a Certificate Authority (CA). Each
end host that wants to participate in the Cisco IOS public key infrastructure (PKI) must obtain a
certificate. Certificate enrollment occurs between the end host requesting the certificate and the CA. The
figure below and the following steps describe the certificate enrollment process.
1.
The end host generates an RSA key pair.
2. The end host generates a certificate request and forwards it to the CA.
3.
The CA receives the certificate enrollment request, and, depending on your network
configuration, one of the following options occurs:
– Manual intervention is required to approve the request.
–
The end host is configured to automatically request a certificate from the CA. Thus, operator
intervention is no longer required at the time the enrollment request is sent to the CA server.
Note
If you configure the end host to automatically request certificates from the CA, you should have an
additional authorization mechanism.
4.
After the request is approved, the CA signs the request with its private key and returns the
completed certificate to the end host.
5. The end host writes the certificate to a storage area such as NVRAM.
Step 1 Step 2 Step 3 Step 4
End Host
RSA key pair
CA receives
request
CA signs request
with private key
Step 5
Storage
end host writes
certificate to
storage
Certificate
request
Certificate
121965