ON THIS PAGE
Example: Improving Security by Configuring OCSP for Certificate Revocation Status
This example shows how to improve security by configuring two peers using the Online Certificate Status Protocol (OCSP) to check the revocation status of the certificates used in Phase 1 negotiations for the IPsec VPN tunnel.
Requirements
On each device:
Obtain and enroll a local certificate. This can be done either manually or by using the Simple Certificate Enrollment Protocol (SCEP).
Optionally, enable automatic renewal of the local certificate.
Configure security policies to permit traffic to and from the peer device.
Overview
On both peers, a certificate authority (CA) profile Root is configured with the following options:
CA name is Root.
Enrollment URL is http://10.1.1.1:8080/scep/Root/. This is the URL where SCEP requests to the CA are sent.
The URL for the OCSP server is http://10.157.88.56:8210/Root/.
OCSP is used first to check the certificate revocation status. If there is no response from the OCSP server, then the certificate revocation list (CRL) is used to check the status. The CRL URL is http://10.1.1.1:8080/crl-as-der/currentcrl-45.crlid=45.
The CA certificate received in an OCSP response is not checked for certificate revocation. Certificates received in an OCSP response generally have shorter lifetimes and a revocation check is not required.
Table 1 shows the Phase 1 options used in this example.
Option |
Peer A |
Peer B |
|---|---|---|
IKE proposal |
ike_policy_ms_2_2_0 |
ike_proposal_ms_2_0_0 |
Authentication method |
rsa-signatures |
rsa-signatures |
DH group |
group2 |
group2 |
Authentication algorithm |
SHA 1 |
SHA 1 |
Encryption algorithm |
3des-cbc |
3des-cbc |
Lifetime seconds |
3000 |
3000 |
IKE policy |
ike_policy_ms_2_2_0 |
ike_policy_ms_2_0_0 |
Mode |
main |
main |
Proposal |
ike_proposal_ms_2_2_0 |
ike_proposal_ms_2_0_0 |
Certificate |
local7_neg |
local7_moji |
Policy |
ike_policy |
ike_policy |
Gateway address |
10.0.1.2 |
192.0.2.0 |
Remote identity |
fqdn company.net |
fqdn company.net |
Local identity |
fqdn company.net |
fqdn company.net |
External interface |
ge-1/3/0 |
ge-1/3/0 |
Version |
1 |
1 |
Table 2 shows the Phase 2 options used in this example.
Option |
Peer A |
Peer B |
|---|---|---|
IPsec proposal |
ipsec_proposal_ms_2_2_0 |
ipsec_proposal_ms_2_0_0 |
Protocol |
esp |
esp |
Authentication algorithm |
hmac-sha1-96 |
hmac-sha1-96 |
Encryption algorithm |
3des-cbc |
3des-cbc |
Lifetime seconds |
2000 |
2000 |
IPsec policy |
ipsec_policy_ms_2_2_0 |
ipsec_policy_ms_2_0_0 |
PFC keys |
group2 |
group2 |
Proposal |
ipsec_proposal_ms_2_2_0 |
ipsec_proposal_ms_2_0_0 |
VPN |
test_vpn |
test_vpn |
Policy |
ipsec_policy |
ipsec_policy |
Establish tunnels |
- |
immediately |
Topology
Figure 1 shows the peer devices that are configured in this example.
Configuration
Configuring Peer A
CLI Quick Configuration
To quickly configure VPN peer A to use OCSP,
copy the following commands, paste them into a text file, remove any
line breaks, change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit]
hierarchy level, and then enter commit from
configuration mode.
set interfaces ge-1/3/0 unit 0 family inet address 10.0.1.2 set interfaces ms-2/2/0 unit 0 family inet set interfaces ms-2/2/0 unit 1 family inet set interfaces ms-2/2/0 unit 1 family inet6 set interfaces ms-2/2/0 unit 1 service-domain inside set interfaces ms-2/2/0 unit 2 family inet set interfaces ms-2/2/0 unit 2 family inet6 set interfaces ms-2/2/0 unit 2 service-domain outside set security pki ca-profile Root ca-identity Root set security pki ca-profile Root enrollment url http://10.1.1.1:8080/scep/Root/ set security pki ca-profile Root revocation-check ocsp url http://10.157.88.56:8210/Root/ set security pki ca-profile Root revocation-check use-ocsp set security pki ca-profile Root revocation-check ocsp disable-responder-revocation-check set security pki ca-profile Root revocation-check ocsp connection-failure fallback-crl set services ipsec-vpn ike proposal ike_prop authentication-method rsa-signatures set services service-set ips_ss1 next-hop-service inside-service-interface ms-2/2/0.1 set services service-set ips_ss1 next-hop-service outside-service-interface ms-2/2/0.2 set services service-set ips_ss1 ipsec-vpn-options local-gateway 10.0.1.2 set services service-set ips_ss1 ipsec-vpn-rules vpn_rule_ms_2_2_01 set services ipsec-vpn rule vpn_rule_ms_2_2_01 term term11 from source-address 203.0.113.0/24 set services ipsec-vpn rule vpn_rule_ms_2_2_01 term term11 from destination-address 198.51.100.0/24 set services ipsec-vpn rule vpn_rule_ms_2_2_01 term term11 then remote-gateway 192.0.2.0 set services ipsec-vpn rule vpn_rule_ms_2_2_01 term term11 then dynamic ike-policy ike_policy_ms_2_2_0 set services ipsec-vpn rule vpn_rule_ms_2_2_01 term term11 then dynamic ipsec-policy ipsec_policy_ms_2_2_0 set services ipsec-vpn rule vpn_rule_ms_2_2_01 match-direction input set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_2_0 protocol esp set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_2_0 authentication-algorithm hmac-sha1-96 set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_2_0 encryption-algorithm 3des-cbc set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_2_0 lifetime-seconds 2000 set services ipsec-vpn ipsec policy ipsec_policy_ms_2_2_0 proposals ipsec_proposal_ms_2_2_0 set services ipsec-vpn ike proposal ike_proposal_ms_2_2_0 authentication-method rsa-signatures set services ipsec-vpn ike proposal ike_proposal_ms_2_2_0 dh-group group2 set services ipsec-vpn ike proposal ike_proposal_ms_2_2_0 lifetime-seconds 3000 set services ipsec-vpn ike policy ike_policy_ms_2_2_0 mode main set services ipsec-vpn ike policy ike_policy_ms_2_2_0 version 1 set services ipsec-vpn ike policy ike_policy_ms_2_2_0 proposals ike_proposal_ms_2_2_0 set services ipsec-vpn ike policy ike_policy_ms_2_2_0 local-id fqdn company.net set services ipsec-vpn ike policy ike_policy_ms_2_2_0 local-certificate local7_neg set services ipsec-vpn ike policy ike_policy_ms_2_2_0 remote-id fqdn company.net set services ipsec-vpn traceoptions level all set services ipsec-vpn traceoptions flag all set services ipsec-vpn establish-tunnels immediately
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.
To configure VPN peer A to use OCSP:
Configure interfaces.
[edit interfaces] set interfaces ge-1/3/0 unit 0 family inet address 10.0.1.2 set interfaces ms-2/2/0 unit 0 family inet set interfaces ms-2/2/0 unit 1 family inet set interfaces ms-2/2/0 unit 1 family inet6 set interfaces ms-2/2/0 unit 1 service-domain inside set interfaces ms-2/2/0 unit 2 family inet set interfaces ms-2/2/0 unit 2 family inet6 set interfaces ms-2/2/0 unit 2 service-domain outside
Configure the CA profile.
[edit security pki ca-profile Root] set security pki ca-profile Root ca-identity Root set security pki ca-profile Root enrollment url http://10.1.1.1:8080/scep/Root/ set security pki ca-profile Root revocation-check ocsp url http://10.157.88.56:8210/Root/ set security pki ca-profile Root revocation-check use-ocsp set security pki ca-profile Root revocation-check ocsp disable-responder-revocation-check set security pki ca-profile Root revocation-check ocsp connection-failure fallback-crl
Configure Phase 1 options.
[edit services ipsec-vpn ike proposal ike_proposal_ms_2_2_0] set services ipsec-vpn ike proposal ike_proposal_ms_2_2_0 authentication-method rsa-signatures set services ipsec-vpn ike proposal ike_proposal_ms_2_2_0 dh-group group2 set services ipsec-vpn ike proposal ike_proposal_ms_2_2_0 lifetime-seconds 3000 [edit services ipsec-vpn ike policy ike_policy_ms_2_2_0] set services ipsec-vpn ike policy ike_policy_ms_2_2_0 mode main set services ipsec-vpn ike policy ike_policy_ms_2_2_0 version 1 set services ipsec-vpn ike policy ike_policy_ms_2_2_0 proposals ike_proposal_ms_2_2_0 set services ipsec-vpn ike policy ike_policy_ms_2_2_0 local-id fqdn company.net set services ipsec-vpn ike policy ike_policy_ms_2_2_0 local-certificate local7_neg set services ipsec-vpn ike policy ike_policy_ms_2_2_0 remote-id fqdn company.net
Configure Phase 2 options.
[edit services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_2_0] set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_2_0 protocol esp set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_2_0 authentication-algorithm hmac-sha1-96 set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_2_0 encryption-algorithm 3des-cbc set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_2_0 lifetime-seconds 2000 [edit services ipsec-vpn ipsec policy ipsec_policy_ms_2_2_0] set services ipsec-vpn ipsec policy ipsec_policy_ms_2_2_0 proposals ipsec_proposal_ms_2_2_0 [edit services service-set ips_ss1] set services service-set ips_ss1 next-hop-service inside-service-interface ms-2/2/0.1 set services service-set ips_ss1 next-hop-service outside-service-interface ms-2/2/0.2 set services service-set ips_ss1 ipsec-vpn-options local-gateway 10.0.1.2 set services service-set ips_ss1 ipsec-vpn-rules vpn_rule_ms_2_2_01 [edit services ipsec-vpn rule vpn_rule_ms_2_2_01] set services ipsec-vpn rule vpn_rule_ms_2_2_01 term term11 from source-address 203.0.113.0/24 set services ipsec-vpn rule vpn_rule_ms_2_2_01 term term11 from destination-address 198.51.100.0/24 set services ipsec-vpn rule vpn_rule_ms_2_2_01 term term11 then remote-gateway 192.0.2.0 set services ipsec-vpn rule vpn_rule_ms_2_2_01 term term11 then dynamic ike-policy ike_policy_ms_2_2_0 set services ipsec-vpn rule vpn_rule_ms_2_2_01 term term11 then dynamic ipsec-policy ipsec_policy_ms_2_2_0 set services ipsec-vpn rule vpn_rule_ms_2_2_01 match-direction input
Results
From configuration mode, confirm your configuration
by entering the show interfaces, show security pki
ca-profile Root, show services ipsec-vpn ike, and show services ipsec-vpn ipsec commands. If the output does
not display the intended configuration, repeat the configuration instructions
in this example to correct it.
[edit]
user@host# show interfaces
ge-1/3/0 {
unit 0 {
family inet {
address 10.0.1.2/24;
}
}
}
ms-2/2/0 {
unit 0 {
family inet;
}
unit 1 {
family inet;
family inet6;
service-domain inside;
}
unit 2 {
family inet;
family inet6;
service-domain inside;
}
}
[edit]
user@host# show security pki ca-profile Root
ca-identity Root;
enrollment {
url http://10.1.1.1:8080/scep/Root/;
}
revocation-check {
ocsp {
url http://10.157.88.56:8210/Root/;
disable-responder-revocation-check;
connection-failure fallback-crl;
}
use-ocsp;
}
[edit]
user@host# show services ipsec-vpn ike
proposal ike_proposal_ms_2_2_0 {
authentication-method rsa-signatures;
dh-group group2;
lifetime-seconds 3000;
}
policy ike_policy_ms_2_2_0 {
mode main;
version 1;
proposals ike_proposal_ms_2_2_0;
local-id fqdn company.net;
local-certificate local7_neg;
remote-id fqdn company.net;
}
[edit]
user@host# show services ipsec-vpn ipsec
proposal ipsec_proposal_ms_2_2_0 {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm 3des-cbc;
lifetime-seconds 2000;
}
policy ipsec_policy_ms_2_2_0 {
proposals ipsec_proposal_ms_2_2_0;
}
If you are done configuring the device, enter commit from configuration mode.
Configuring Peer B
CLI Quick Configuration
To quickly configure VPN peer B to use OCSP,
copy the following commands, paste them into a text file, remove any
line breaks, change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit]
hierarchy level, and then enter commit from
configuration mode.
set interfaces ge-1/3/0 unit 0 family inet address 192.0.2.0/24 set interfaces ms-2/0/0 unit 0 family inet set interfaces ms-2/0/0 unit 1 family inet set interfaces ms-2/0/0 unit 1 family inet6 set interfaces ms-2/0/0 unit 1 service-domain inside set interfaces ms-2/0/0 unit 2 family inet set interfaces ms-2/0/0 unit 2 family inet6 set interfaces ms-2/0/0 unit 2 service-domain outside set security pki ca-profile Root ca-identity Root set security pki ca-profile Root enrollment url http://10.1.1.1:8080/scep/Root/ set security pki ca-profile Root revocation-check ocsp url http://10.157.88.56:8210/Root/ set security pki ca-profile Root revocation-check use-ocsp set security pki ca-profile Root revocation-check ocsp disable-responder-revocation-check set security pki ca-profile Root revocation-check ocsp connection-failure fallback-crl set services service-set ips_ss1 next-hop-service inside-service-interface ms-2/0/0.1 set services service-set ips_ss1 next-hop-service outside-service-interface ms-2/0/0.2 set services service-set ips_ss1 ipsec-vpn-options local-gateway 192.0.2.0 set services service-set ips_ss1 ipsec-vpn-rules vpn_rule_ms_2_0_01 set services ipsec-vpn rule vpn_rule_ms_2_0_01 term term11 from source-address 203.0.113.0/24 set services ipsec-vpn rule vpn_rule_ms_2_0_01 term term11 from destination-address 198.51.100.0/24 set services ipsec-vpn rule vpn_rule_ms_2_0_01 term term11 then remote-gateway 10.0.1.2 set services ipsec-vpn rule vpn_rule_ms_2_0_01 term term11 then dynamic ike-policy ike_policy_ms_2_0_0 set services ipsec-vpn rule vpn_rule_ms_2_0_01 term term11 then dynamic ipsec-policy ipsec_policy_ms_2_0_0 set services ipsec-vpn rule vpn_rule_ms_2_0_01 match-direction input set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_0_0 protocol esp set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_0_0 authentication-algorithm hmac-sha1-96 set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_0_0 encryption-algorithm 3des-cbc set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_0_0 lifetime-seconds 2000 set services ipsec-vpn ipsec policy ipsec_policy_ms_2_0_0 proposals ipsec_proposal_ms_2_0_0 set services ipsec-vpn ike proposal ike_proposal_ms_2_0_0 authentication-method rsa-signatures set services ipsec-vpn ike proposal ike_proposal_ms_2_0_0 dh-group group2 set services ipsec-vpn ike proposal ike_proposal_ms_2_0_0 lifetime-seconds 3000 set services ipsec-vpn ike policy ike_policy_ms_2_0_0 mode main set services ipsec-vpn ike policy ike_policy_ms_2_0_0 version 1 set services ipsec-vpn ike policy ike_policy_ms_2_0_0 proposals ike_proposal_ms_2_0_0 set services ipsec-vpn ike policy ike_policy_ms_2_0_0 local-id fqdn company.net set services ipsec-vpn ike policy ike_policy_ms_2_0_0 local-certificate local7_moji set services ipsec-vpn ike policy ike_policy_ms_2_0_0 remote-id fqdn company.net set services ipsec-vpn traceoptions level all set services ipsec-vpn traceoptions flag all
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.
To configure VPN peer B to use OCSP:
Configure interfaces.
[edit interfaces] set interfaces ge-1/3/0 unit 0 family inet address 192.0.2.0/24 set interfaces ms-2/0/0 unit 0 family inet set interfaces ms-2/0/0 unit 1 family inet set interfaces ms-2/0/0 unit 1 family inet6 set interfaces ms-2/0/0 unit 1 service-domain inside set interfaces ms-2/0/0 unit 2 family inet set interfaces ms-2/0/0 unit 2 family inet6 set interfaces ms-2/0/0 unit 2 service-domain outside
Configure the CA profile.
[edit security pki ca-profile Root] set security pki ca-profile Root ca-identity Root set security pki ca-profile Root enrollment url http://10.1.1.1:8080/scep/Root/ set security pki ca-profile Root revocation-check ocsp url http://10.157.88.56:8210/Root/ set security pki ca-profile Root revocation-check use-ocsp set security pki ca-profile Root revocation-check ocsp disable-responder-revocation-check set security pki ca-profile Root revocation-check ocsp connection-failure fallback-crl
Configure Phase 1 options.
[edit services ipsec-vpn ike proposal ike_proposal_ms_2_0_0] set services ipsec-vpn ike proposal ike_proposal_ms_2_0_0 authentication-method rsa-signatures set services ipsec-vpn ike proposal ike_proposal_ms_2_0_0 dh-group group2 set services ipsec-vpn ike proposal ike_proposal_ms_2_0_0 lifetime-seconds 3000 [edit services ipsec-vpn ike policy ike_policy_ms_2_0_0] set services ipsec-vpn ike policy ike_policy_ms_2_0_0 mode main set services ipsec-vpn ike policy ike_policy_ms_2_0_0 version 1 set services ipsec-vpn ike policy ike_policy_ms_2_0_0 proposals ike_proposal_ms_2_0_0 set services ipsec-vpn ike policy ike_policy_ms_2_0_0 local-id fqdn company.net set services ipsec-vpn ike policy ike_policy_ms_2_0_0 local-certificate local7_moji set services ipsec-vpn ike policy ike_policy_ms_2_0_0 remote-id fqdn company.net
Configure Phase 2 options.
[edit services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_0_0] set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_0_0 protocol esp set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_0_0 authentication-algorithm hmac-sha1-96 set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_0_0 encryption-algorithm 3des-cbc set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_0_0 lifetime-seconds 2000 [edit services ipsec-vpn ipsec policy ipsec_policy_ms_2_0_0] set services ipsec-vpn ipsec policy ipsec_policy_ms_2_0_0 proposals ipsec_proposal_ms_2_0_0 [edit services service-set ips_ss1] set services service-set ips_ss1 next-hop-service inside-service-interface ms-2/0/0.1 set services service-set ips_ss1 next-hop-service outside-service-interface ms-2/0/0.2 set services service-set ips_ss1 ipsec-vpn-options local-gateway 192.0.2.0 set services service-set ips_ss1 ipsec-vpn-rules vpn_rule_ms_2_0_01 [edit services ipsec-vpn rule vpn_rule_ms_2_0_01] set services ipsec-vpn rule vpn_rule_ms_2_0_01 term term11 from source-address 203.0.113.0/24 set services ipsec-vpn rule vpn_rule_ms_2_0_01 term term11 from destination-address 198.51.100.0/24 set services ipsec-vpn rule vpn_rule_ms_2_0_01 term term11 then remote-gateway 10.0.1.2 set services ipsec-vpn rule vpn_rule_ms_2_0_01 term term11 then dynamic ike-policy ike_policy_ms_2_0_0 set services ipsec-vpn rule vpn_rule_ms_2_0_01 term term11 then dynamic ipsec-policy ipsec_policy_ms_2_0_0 set services ipsec-vpn rule vpn_rule_ms_2_0_01 match-direction input
Results
From configuration mode, confirm your configuration
by entering the show interfaces, show security pki
ca-profile Root, show services ipsec-vpn ike, and show services ipsec-vpn ipsec commands. If the output does
not display the intended configuration, repeat the configuration instructions
in this example to correct it.
[edit]
user@host# show interfaces
ge-1/3/0 {
unit 0 {
family inet {
address 192.0.2.0/24;
}
}
}
ms-2/0/0 {
unit 0 {
family inet;
}
unit 1 {
family inet;
family inet6;
service-domain inside;
}
unit 2 {
family inet;
family inet6;
service-domain inside;
}
}
[edit]
user@host# show security pki ca-profile Root
ca-identity Root;
enrollment {
url http://10.1.1.1:8080/scep/Root/;
}
revocation-check {
ocsp {
url http://10.157.88.56:8210/Root/;
disable-responder-revocation-check;
connection-failure fallback-crl;
}
use-ocsp;
}
[edit]
user@host# show services ipsec-vpn ike
proposal ike_proposal_ms_2_0_0 {
authentication-method rsa-signatures;
dh-group group2;
lifetime-seconds 3000;
}
policy ike_policy_ms_2_0_0 {
mode main;
version 1;
proposals ike_proposal_ms_2_0_0;
local-id fqdn company.net;
local-certificate local7_moji;
remote-id fqdn company.net;
}
[edit]
user@host# show services ipsec-vpn ipsec
proposal ipsec_proposal_ms_2_0_0 {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm 3des-cbc;
lifetime-seconds 2000;
}
policy ipsec_policy_ms_2_0_0 {
proposals ipsec_proposal_ms_2_0_0;
}
If you are done configuring the device, enter commit from configuration mode.
Verification
Confirm that the configuration is working properly.
- Verifying CA Certificates
- Verifying Local Certificates
- Verifying IKE Phase 1 Status
- Verifying IPsec Phase 2 Status
Verifying CA Certificates
Purpose
Verify the validity of a CA certificate on each peer device.
Action
From operational mode, enter the show security
pki ca-certificate ca-profile Root or show security pki
ca-certificate ca-profile Root detail command.
user@host> show security pki ca-certificate ca-profile Root
Certificate identifier: Root
Issued to: Root, Issued by: C = US, O = Juniper, CN = Root
Validity:
Not before: 07- 3-2015 10:54 UTC
Not after: 07- 1-2020 10:54 UTC
Public key algorithm: rsaEncryption(2048 bits)
user@host> show security pki ca-certificate ca-profile Root detail
Certificate identifier: Root
Certificate version: 3
Serial number: 0000a17f
Issuer:
Organization: Juniper, Country: US, Common name: Root
Subject:
Organization: Juniper, Country: US, Common name: Root
Subject string:
C=US, O=Juniper, CN=Root
Validity:
Not before: 07- 3-2015 10:54 UTC
Not after: 07- 1-2020 10:54 UTC
Public key algorithm: rsaEncryption(2048 bits)
30:82:01:0a:02:82:01:01:00:c6:38:e9:03:69:5e:45:d8:a3:ea:3d
2e:e3:b8:3f:f0:5b:39:f0:b7:35:64:ed:60:a0:ba:89:28:63:29:e7
27:82:47:c4:f6:41:53:c8:97:d7:1e:3c:ca:f0:a0:b9:09:0e:3d:f8
76:5b:10:6f:b5:f8:ef:c5:e8:48:b9:fe:46:a3:c6:ba:b5:05:de:2d
91:ce:20:12:8f:55:3c:a6:a4:99:bb:91:cf:05:5c:89:d3:a7:dc:a4
d1:46:f2:dc:36:f3:f0:b5:fd:1d:18:f2:e6:33:d3:38:bb:44:8a:19
ad:e0:b1:1a:15:c3:56:07:f9:2d:f6:19:f7:cd:80:cf:61:de:58:b8
a3:f5:e0:d1:a3:3a:19:99:80:b0:63:03:1f:25:05:cc:b2:0c:cd:18
ef:37:37:46:91:20:04:bc:a3:4a:44:a9:85:3b:50:33:76:45:d9:ba
26:3a:3b:0d:ff:82:40:36:64:4e:ea:6a:d8:9b:06:ff:3f:e2:c4:a6
76:ee:8b:58:56:a6:09:d3:4e:08:b0:64:60:75:f3:e2:06:91:64:73
d2:78:e9:7a:cb:8c:57:0e:d1:9a:6d:3a:4a:9e:5b:d9:e4:a2:ef:31
5d:2b:2b:53:ab:a1:ad:45:49:fd:a5:e0:8b:4e:0b:71:52:ca:6b:fa
8b:0e:2c:7c:7b:02:03:01:00:01
Signature algorithm: sha1WithRSAEncryption
Distribution CRL:
http://10.1.1.1:8080/crl-as-der/currentcrl-45.crl?id=45
Authority Information Access OCSP:
http://10.1.1.1:8090/Root/
Use for key: CRL signing, Certificate signing, Key encipherment, Digital signature
Fingerprint:
ed:ce:ec:13:1a:d2:ab:0a:76:e5:26:6d:2c:29:5d:49:90:57:f9:41 (sha1)
af:87:07:69:f0:3e:f7:c6:b8:2c:f8:df:0b:ae:b0:28 (md5)
In this example, IP addresses are used in the URLs in the CA profile configuration. If IP addresses are not used with CA-issued certificates or CA certificates, DNS must be configured in the device’s configuration. DNS must be able to resolve the host in the distribution CRL and in the CA URL in the CA profile configuration. Additionally, you must have network reachability to the same host to receive revocation checks.
Meaning
The output shows the details and validity of CA certificate on each peer as follows:
C—Country.O—Organization.CN—Common name.Not before—Begin date of validity.Not after—End date of validity.
Verifying Local Certificates
Purpose
Verify the validity of a local certificate on each peer device.
Action
From operational mode, enter the show security
pki local-certificate certificate-id localcert1 detail command.
user@host> show security pki local-certificate certificate-id local7_neg detail
Certificate identifier: local7_neg
Certificate version: 3
Serial number: 0007d964
Issuer:
Organization: juniper, Country: us, Common name: Subca2
Subject:
Organization: juniper, Organizational unit: marketing, State: california, Locality: sunnyvale, Common name: local, Domain component: juniper
Subject string:
DC=juniper, CN=local, OU=marketing, O=juniper, L=sunnyvale, ST=california, C=us
Alternate subject: "test@company.net", company.net, 10.0.0.2
Validity:
Not before: 04- 5-2016 03:30 UTC
Not after: 07- 1-2020 10:54 UTC
Public key algorithm: rsaEncryption(1024 bits)
30:81:89:02:81:81:00:b9:44:42:0e:26:5a:46:8e:a7:9c:b9:15:a5
f1:38:e4:59:59:9d:84:75:ee:7a:64:ca:0a:a7:68:3b:2b:0c:dc:a8
de:60:df:07:80:23:58:7d:56:dd:4f:50:de:a4:57:f1:a0:df:a9:7a
6c:3d:e0:6d:7a:cf:ef:af:95:1b:12:7a:c4:54:61:12:db:65:0c:f9
25:40:2d:01:71:21:8a:fc:fc:f6:9d:db:5a:63:ca:1a:92:2b:a3:98
f6:6b:e4:23:67:53:92:6a:5e:ad:ae:d7:82:ab:32:c1:60:6f:01:14
fd:46:bd:3f:b3:6b:fd:e6:41:de:6d:94:0d:6f:ad:02:03:01:00:01
Signature algorithm: sha256WithRSAEncryption
Distribution CRL:
http://10.1.1.1:8080/crl-as-der/currentcrl-1925.crl?id=1925
Authority Information Access OCSP:
http://10.204.128.120:8090/Subca2/
Fingerprint:
69:00:fe:e1:81:37:ab:54:27:81:ce:57:11:a1:f2:d8:00:e7:e6:c7 (sha1)
1e:27:93:a1:96:eb:28:0c:dc:f3:50:20:bb:eb:ed:57 (md5)
Auto-re-enrollment:
Status: Disabled
Next trigger time: Timer not startedMeaning
The output shows the details and validity of a local certificate on each peer as follows:
DC—Domain component.CN—Common name.OU—Organizational unit.O—Organization.L—LocalityST—State.C—Country.Not before—Begin date of validity.Not after—End date of validity.
Verifying IKE Phase 1 Status
Purpose
Verify the IKE Phase 1 status on each peer device.
Action
From operational mode, enter the show services
ipsec-vpn ike security-associations command.
user@host> show services ipsec-vpn ike security-associations Remote Address State Initiator cookie Responder cookie Exchange type 192.0.2.0 Matured 63b3445edda507fb 2715ee5895ed244d Main
From operational mode, enter the show services ipsec-vpn
ike security-associations detail command.
user@host> show services ipsec-vpn ike security-associations detail IKE peer 192.0.2.0 Role: Initiator, State: Matured Initiator cookie: 63b3445edda507fb, Responder cookie: 2715ee5895ed244d Exchange type: Main, Authentication method: RSA-signatures Local: 10.0.1.2, Remote: 192.0.2.0 Lifetime: Expires in 788 seconds Algorithms: Authentication : hmac-sha1-96 Encryption : 3des-cbc Pseudo random function: hmac-sha1 Diffie-Hellman group : 2 Traffic statistics: Input bytes : 3100 Output bytes : 4196 Input packets: 7 Output packets: 9 Flags: IKE SA created IPSec security associations: 4 created, 4 deleted
Meaning
The flags field in the output shows that,
IKE security association is created.
Verifying IPsec Phase 2 Status
Purpose
Verify the IPsec Phase 2 status on each peer device.
Action
From operational mode, enter the show services
ipsec-vpn ipsec security-associations command.
user@host> show services ipsec-vpn ipsec security-associations
Service set: ips_ss1, IKE Routing-instance: default
Rule: vpn_rule_ms_2_2_01, Term: term11, Tunnel index: 1
Local gateway: 10.0.1.2, Remote gateway: 192.0.2.0
IPSec inside interface: ms-2/2/0.1, Tunnel MTU: 1500
UDP encapsulate: Disabled, UDP Destination port: 0
Direction SPI AUX-SPI Mode Type Protocol
inbound 2151932129 0 tunnel dynamic ESP
outbound 4169263669 0 tunnel dynamic ESP From operational mode, enter the show services ipsec-vpn
ipsec security-associations detail command.
user@host> show services ipsec-vpn ipsec security-associations detail
Service set: ips_ss1, IKE Routing-instance: default
Rule: vpn_rule_ms_2_2_01, Term: term11, Tunnel index: 1
Local gateway: 10.0.1.2, Remote gateway: 192.0.2.0
IPSec inside interface: ms-2/2/0.1, Tunnel MTU: 1500
UDP encapsulate: Disabled, UDP Destination port: 0
Local identity: ipv4_subnet(any:0,[0..7]=80.0.0.0/16)
Remote identity: ipv4_subnet(any:0,[0..7]=30.0.0.0/16)
Direction: inbound, SPI: 3029124496, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
Soft lifetime: Expires in 840 seconds
Hard lifetime: Expires in 1273 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Disabled, ToS value: 0
Copy TTL: Disabled, TTL value: 64
Direction: outbound, SPI: 4046774180, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
Soft lifetime: Expires in 840 seconds
Hard lifetime: Expires in 1273 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Disabled, ToS value: 0
Copy TTL: Disabled, TTL value: 64Meaning
The output shows the ipsec security associations details.