Cisco Application :: ACE Supports 4096-bit SSL Certificates?
Dec 12, 2012
I have some questions about the size of the certifcates in ACE module (ACE20). Reading the following link: [URL]
I can verify this text: 4096 (high security, level 4) - For software release A2(2.4) and later in the ACE module and software release A3(2.6) and later in the ACE appliance, you can use 4096-bit SSL certificates in chaingroups and authgroups. You can also import public certificates and keys that are 4096 bits in length.
We intend to use a certificate (CA) with keys of 4096 bits and according to the text of wiki, it's possible.
But if I check the guide [URL]
Somebody that already use certificates with 4096 bits in ACE20 module?
View 3 Replies
ADVERTISEMENT
Jul 10, 2012
Any switch that supports 4096 multicast groups?I am working on a system that includes over a dozen catalyst 2960 switches. The customer has pointed out the 2960 switch does not satisfy the requirement to support 4096 multicast groups (even though it is more than adequate for the number of active multicast groups). It looks like the 3560 supports more multicast groups than the 2960, but is still far less than the requirement.
View 1 Replies
View Related
Sep 17, 2012
I'm working on task to update the SSL certificate for an application. steps to upgrade the SSL, stuffs need to be checked before and after the installation and how to verify the new certificates.
View 1 Replies
View Related
Jul 19, 2011
We have an ASA 5520 using for VPN & would like make use ASA's local CA to manage certificate.Do you know if there's any limitation on number of certificates that the local CA supports ?
View 6 Replies
View Related
May 17, 2012
I am facing a problem while updating the SSL certificates in ACE 4710. Our certificate is expired and we have purchased a new certificate from CA. Moreover the common name of the certificate is also changed.
I tried importing the certificate to the repository and change the SSL proxy likewise to use the new certificate. but still the new certificate with new CN is not recognised by the clients. they can see the old certificate only. I even tried deleting and creating a new ssl proxy service with the new cert and attaching it to policy map.
View 2 Replies
View Related
Oct 2, 2012
I'm having an issue with intermediate certificates from GoDaddy when connecting from some browsers of mobile devices:Browser in Android 2.3.3;Safari in iOS 4.2.1;Chrome 18 in Android 4.0.In a PC there's no problem, only from the above mobile devices. The intermediate certificate isn't downloaded from the ACE 4710 resulting in a "SSL Certificate Not Trusted" error.Since GoDaddy has no instructions to resolve the issue from a Cisco ACE.
View 6 Replies
View Related
Sep 1, 2010
Does ACE service module support SHA2(256) certificates? I see that private key generation defaults to SHA1 and does not provide any option, also the cipher suites in SSL parameters map do not show SHA2 options. Can it handle SHA2 in any software release? I am currently running A2(2.3) build 3.00
View 6 Replies
View Related
Jul 17, 2012
whether Cisco GSS 4492R supports NTP authentication. GSS Software version : 4.1.0.0.28
View 1 Replies
View Related
Jun 26, 2011
I am configuring a GSS to check an Web server that responds to https requests.I put 443 as the port but I don´t see replies from the server and the Answer Status is always offline.Other servers using http on port 80 are showing OK.The appliance is a GSS-4492-k9 Version 3.1(0).
View 2 Replies
View Related
Aug 31, 2011
Is it possible to generate a public RSA key of 4096-bits on an IOS router? We are running 12.4(24)T5. Have been going through some cisco doc and found this:
Cisco IOS 4096-Bit Public Key Support in IOS 12.4(11) and later.
However when I issue the command,crypto ca trustpoint exampleCAkeys, rsakeypair exampleCAkeys ?
it only shows me the maximum of 2048. Am I missing something? Currently our root cert has a public key of 2048 and the routers a key of 1024. The goal is to increase the root cert and our routers cert to 4096-bits. If that's possible.
View 6 Replies
View Related
Nov 15, 2011
a number of vlan on trunk is 4096, can I limit this number? I need trunk pass only 10 vlans.
View 1 Replies
View Related
Sep 21, 2012
logging buffered 4096 warnings The above causes router to log all the events with severity level 4 or below in buffer.What about logging console warnings command?will the above command cause router to send log messages with severity level 4( warnings severity level) to console only or will the router send all the log messages with severity level 4 or below to console ?
View 3 Replies
View Related
May 8, 2012
May I know how to manually set the priority (root ID and bridge ID priority) and for spanning tree? Which one should I use based on the command below? and how does it affect the path cost of it?
set spantree root 1
spanning vlan1 priority 4096
View 5 Replies
View Related
Aug 27, 2012
I have access to an ASA running 8.4 and I need to copy the config to another one, to have it has as a spare.All configuration has coppied fine except for this part in the config;
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=GS2-NT-FIR-01
proxy-ldc-issuer
crl configure
[code]....
So firstly, I assume this certificate is for the SSL vpn that is configured on the ASA? Secondly, this wouldn't copy across (the HEX part). But I believe this ASA is using a self signed cert so instead I probably ned to generate a new one on this spare ASA, so how do I do that?
View 3 Replies
View Related
Aug 8, 2011
I am delving into the world of Certificates and the ASA. I am having the HARDEST time grasping this though. I've poured over Cisco whitepapers, been reading through books and things just aren't solidifying in my head. So my question is, how do Certificates for SSL work on the ASA? Where does the data transmit and how does an ASA talk to a CA and User for things?
Lets do this basic topology for the discussion:
End User------SSL VPN---> ASA--->Internal CA
So in theory we are supposed to create a certificate and install it on the ASA and then set the outside interface to trust that cert?
How do identity certs and root certs also work out on the ASA? I have instructions that pretty much say
Create RSA key
Create new trustpoint
cry ca auth newtrustpoint
cry ca enroll newtrustpoint
cry ca import ?
So what are all of these steps specifically doing? Also in ASDM it shows a normal Certificate and an Identity Certificate. I can't really figure out the difference between the two. Does one cert talk to the CA and the other identify the ASA to the CA?
View 7 Replies
View Related
Aug 16, 2012
My ASA's have the follwing Versions: ASA Version 8.4(3) ASDM Version 6.4(7)Have I a chance to configure a site-to-site tunnel with a hostname as peer address when I will use Identity and CA Certificates?
View 2 Replies
View Related
Dec 5, 2011
I want to use a different certificate by connection profile. Is-it possible on ASA 8.4 ?
My first certificate is for vpn.itcom.fr associated to one connection profile and my second is for vpn.newitcom.fr associated to a second connection profile.
View 2 Replies
View Related
Jan 31, 2012
I have generated request and our CA server gave us two files, one is certificate from CA itself, one is the certificate CA created for the ACS. I used the "Bind CA Signed Cerficate" under "local certificated"Option to bind the latter. it shows successful.and a web access from any pc will give you error info, "that the security certificate presented by this website was issued for a different website's address." And all the while I dont know how to deal with the other file, which is "Internal CA certificates" I was try to use the first option import server option, but it seems not right,
View 1 Replies
View Related
Mar 10, 2008
I have configured MS CA and i setup vpn client and ASA 7.0 to make tunnel with certificates.Same configuration does not work with ASA 8.0 I get error
CRYPTO_PKI: Checking to see if an identical cert is
already in the database...
CRYPTO_PKI: looking for cert in handle=d4bb2888, digest=
b8 e5 74 97 f3 bf 25 1c 2e e5 21 3e d1 93 d6 15 | ..t...%...!>....
CRYPTO_PKI: Cert record not found, returning E_NOT_FOUND
CRYPTO_PKI: Cert not found in database.
[code]....
Why the key usage is invalid? What certificate template must be used in MS CA in order to get a regular key usage?
View 3 Replies
View Related
Sep 4, 2012
I have an ASA5540 running 8.4(3) which has CA and identity certificates from godaddy.com installed, identifying the ASA to VPN remote users (the are using the anyconnect client.) There is also a separate certificate server located on the inside LAN that is used for internal purposes. All client workstations have identity certs from this internal server.
We would like to be able to continue using the existing godaddy CA/identity certs to identify the ASA to the clients, but we'd like to use the internal CA server to identify the clients when they initiate the AnyConnect session to the ASA.
I have seen other postings that state you cannot have more than one vert on an interface, but this is a little different - only one cert needs to be used to identify the ASA. The other one is only to identify the users. The ASA did allow me to import the internal CA cert.
View 4 Replies
View Related
Jan 19, 2012
Which certificates do I install on the ASA 5510 ???
I have a Trust External CA Root, Trust Server CA, Extended Validation Secure Server CA and the name of the domain all ending in CRT. Yet the instructions only refer to two certificates ?
View 2 Replies
View Related
Feb 10, 2011
I want to use multiple cert (enterprise certs and verisign cert) for authentication in wireless.Users that have their computer in the domain should use EAP-TLS and PEAP (verisign) are for users in the domain but on non-domain computers.I can only enable one certificate in system adminstration->local server certificates-> local certificates to use EAP.I have installed both enterprise and verisign cert in the CA store in User and Identy store and enbled the enterprise cert for EAP-TLS.The EAP-TLS connection works fine when the enterprise cert is enabled for EAP (in local certificates) but PEAP does not. If I enable EAP on the verisign cert in local certificates the enterprise cert get EAP disabled and that authentication stops working av PEAP starts working.
Is the ACS5.2 only able to have one certificate enabled at the time for EAP?
View 10 Replies
View Related
Oct 6, 2011
I've tried to piece this together with SSL Remote Access VPNS, Understanding PKI and the Cisco's ASA 5500 Series Chapter 73 Configuring Digital Certificates. Below is a basic config I use to create the CA and ID certs on ASAs. I use the ASA as the CA server. When I export the SSL trust point it doesn't show chaining from the CA. Since there is no chaining when I load the CA certificate in the Root Store I still an SSL Certificate error. Instead I have to load the SSL Trustpoint Certificate.
CREATE CA
crypto ca server
smtp from-address admin@Cisco.local
lifetime ca 3650
lifetime certificate 3650
lifetime crl 24
[code]....
I originally thought it was a problem with enrollment self in the trustpoint, but I cannot figure out the steps to complete enrollment terminal. I got to the steps of crypto ca enroll Identity_Certificate and displayed the certificate request. At that point the sh crypto ca trustpoint Identity_Certificate is pending enrollment. I can not find the command for the CA that allows trustpoint enrollment. If I try to crypto ca export Identity_Cetificate identity-certificateit says trustpoint not enrolled. Of course if I take the enrollment request and attempt to crypto ca import Identity_Certificate certificate it fails because it's not the cert.
View 3 Replies
View Related
Apr 23, 2011
We're looking to deploy a certificate-based VPN solution for users with mobile devices (iPhone, iPad, and Android devices at minimum).We currently have CheckPoint firewalls (with VPN capabilities, currently unused), SonicWall, and Aventail devices at our disposal, but would not be against adding new equipment if the solution is secure, easy to deploy, and easy to manage.We want to use client certificates for authentication, though we currently have no infrastructure in place for such a thing.I'm looking for starting points/reference documents to learn to deploy:
* Certificate infrastructure, including a secure and manageable way to deploy certificates to devices, and revoke them if devices are lost or stolen.
* VPN concentrator configuration guides (whether it be Cisco or one of our existing VPN-capable devices).
View 2 Replies
View Related
Jun 2, 2011
Has anyone tried to get two factor authentication working with the asa 5505. I have a CA setup and the enrollment emails are being sent out. But when I go to login to the enrollment site at [URL]. I get a page not found.
I would like to have one factor be a username and password and the second factor being a certificate on the device.
View 4 Replies
View Related
Apr 23, 2013
how the certificates work when using PEAP on ACS 5.2.Currently we have clients which are Cisco wireless IP phones that are using the ACS server(s) for authentication to the wireless network. The phones are configured to use PEAP with server validation enabled. The phones have a Godaddy root certificate, and Godaddy intermediate certificates installed on them, (in addition they have all the certs that are on the phone by default). On the ACS server there is a certificate that is signed by Godaddy. This was creating doing the CSR process etc...
So from what I understand, because all the phones are set up to validate the server certificate, they require the public root certs and the intermediate certs that are installed on them, in order to validate the private cert that is on the ACS server. The private certificate (the one signed and issued by Godaddy), expires the middle of next year (2014) (a little ways off I know, but it is never too early be concerned about stuff). When we go to get a new private certificate for the ACS servers (or get a renewal) and when we install this new signed certificate onto the ACS servers…will all the clients still trust this new certificate, and everything will continue to work smoothly? Or will the clients all need to have new root certs installed, and new intermediate certificates installed? From what I can gather I think the first scenario should be the case, because the root certs and intermediate certs are there to trust certs that are signed by Godaddy, so as long as the new private certificate is signed by Godaddy everything should be okay.
View 8 Replies
View Related
Jun 9, 2013
I have issues connecting to the webvpn as its asking for some certificate for authentication, I am using the self generated certificate, but when I try to connect to SSL gateway via its IP address , Browser expect me to provide the certificated, I want to tell the Browser to use the self generated certificate of ASA5505, but not sure how I do it.I undestand when WEBVPN/SSL clientless VPN try to establish the VPN , ASA sends the certificate back to the browser to accept/authenticate it, but when I connect I don't get any certificate where I say YES to accept it.Can I just disable certificate with SSL and just use username/password to crater a WEBVPN ?
View 7 Replies
View Related
Jun 7, 2012
I have a Cisco 4506 With IOS 12.2 54SG1
Iam new on Acs 4.2 and i want to use Certificates to authenticate my windows XP Client and Igels.
On Windows Xp i selected : IEEE 802.1X Authentication enable EAP (Peap)
But i dont understand the Certification of ACS 4.2.
I generated a Self-Signed Certificate. Is this right ? and under installed Certificates the Certificate Status is okay.
Do i have to create for each windows Machine one user Account under user-Setup to authenticate the Machine?
Where do Windows Xp know whitch Certificate he have to take ?
I configures the Switch on Global Configuration like this:
aaa authentication login default group tacacs+ enable
aaa authentication enable default group tacacs+ enable
[Code].....
Iam triying to configure ist szenario till 4 days and it still dont work.. On Windows i Only get the Error" authentication failed" on the Switch the same : dot1x : Authfailed
View 3 Replies
View Related
Sep 25, 2011
I'm looking for samples about anyconnect 2.x with PKI authentication through ASA 8.x and ACS 5.2.The CA could be a internal Microsoft CA.
View 8 Replies
View Related
Oct 10, 2011
I have a Cisco ASA 5505 as a BOVPN endpoint using certificates. The config is complete and I now need to back it up and restore to a cold standby Cisco ASA 5505 that will sit on the shelf until something goes wrong.
Problem is I cannot restore my certifcates to the standby.
I have tried the backup and restore wizard in ASDM and to be honest it didn't work.
View 2 Replies
View Related
Dec 18, 2012
Recently we updated to the Anyconnect 3.0 client. I see the new 3.1 client is out and we are currently testing it for production. My question though is since updating to 3.0 our end users receive a message at the bottom of their client stating "No valid certificates available for authentication" They can still VPN in since we dont do certificate based authentication but we have been getting tons of questions on this. I would like to stop these messages from appearing and I am not sure if its just how the new client behaves or if its something configured on our ASA's.
View 1 Replies
View Related
Jan 10, 2012
When I tried to import the file, there are two lines there, One is Certificate file, the other is for "Private Key File".
My question for you is, is this the private key of CA? My understanding has always been that the private key stays in CA only, not going to any other devices.
View 2 Replies
View Related
Apr 16, 2013
is there a easy to install SSL certificate on ASA, rather than enroll with a public CA? ASDM has a place to import certificates. Can I just upload a SSL certificate I got from my CA to ASA, withou setup CA enrollment? And if yes, how can I generate a SSL certificate request from my ASA 8.2?
View 2 Replies
View Related