HP Pavilion a6600, Руководство по настройке

Страница: 249 / 501

237
Authority Information Access:
CA Issuers - URI:http://l00192b/CertEnroll/l00192b_CA%20server.crt
CA Issuers - URI:file://\\l00192b\CertEnroll\l00192b_CA server.crt
1.3.6.1.4.1.311.20.2:
.0.I.P.S.E.C.I.n.t.e.r.m.e.d.i.a.t.e.O.f.f.l.i.n.e
also use some other display commands to view more information about the CA certificate. For more
information about display pki certificate ca domain , see Security Command Reference .
Applying RSA digital signature in IKE negotiation
Network requirements
•
An IPsec tunnel is set up between Router A and Router B to secure the traffic between Host A on
subnet 10.1.1.0/24 and Host B on subnet 11.1.1.0/24.
•
Router A and Router B use IKE for IPsec tunnel negotiation and RSA digital signature of a PKI
certificate system for identity authentication.
•
As shown in Figure 88 , Router A and Router B use different CAs. They might also use the same CA
as required.
Figure 88 Apply RSA digital signature in IKE negotiation
Internet
RA 1
1.1.1.100/32
LDAP 1
1.1.1.102/32
CA 1
1.1.1.101/32
RA 2
2.1.1.100/32
LDAP 2
2.1.1.102/32
CA 2
2.1.1.101/32
PKI certificate system
Router A Router B
Host A
Host B
S2/0/1
2.2.2.1/24
S2/0/1
3.3.3.1/24
GE1/0/1
10.1.1.1/24
GE1/0/1
11.1.1.1/24
10.1.1.2/24 11.1.1.2/24