CloudLabBox
Try the free demo

Firewalls and VPNs lab 9 of 16

Certificate authentication - an OpenSSL CA for IOS and vSRX

Replace pre-shared keys with certificates. Run a small certificate authority with OpenSSL, load an identity certificate onto a Cisco IOS router and a Juniper vSRX, and bring up IKEv2 with RSA signatures and FQDN identities that each side checks against the other's certificate.

Run this lab

It needs Lite: its 5 nodes are set to 6 vCPU and 6,656 MB in total. That fits the free demo too.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 09 - Certificate authentication - an OpenSSL CA for IOS and vSRX

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 100 minutes
Nodes need
6 vCPU, 6,656 MB
Smallest plan
Lite

The scenario

Ashcombe Veterinary Group has outgrown shared keys: twenty clinics, one key each, and nobody knows who has seen them. It is moving its VPNs to certificates. You will pilot it between HQ (a Cisco router) and one clinic (a Juniper vSRX), with a small certificate authority (CA) that you run yourself with OpenSSL.

DeviceInterfaceAddressNotes
ISPGi0/0 / Gi0/1 / Gi0/2203.0.113.1/30 / 198.51.100.1/30 / 192.0.2.1/24
CAeth0192.0.2.50/24Reachable from both sites over the internet
HQGi0/0 / Lo0 / Tunnel0203.0.113.2/30 / 10.1.0.1/24 / 172.16.9.1/30Identity hq.example
SRX-CLge-0/0/0 / ge-0/0/1 (zone trust) / st0.0198.51.100.2/30 / 10.2.0.1/24 / 172.16.9.2/30Identity srx.example
CL-PCGi0/010.2.0.10/24Clinic workstation
SettingValue
CALAB-CA, RSA 2048, SHA-256, valid 10 years
Identity certificatesRSA 2048, SHA-256, subject CN=hq.example / CN=srx.example, the same name as a DNS subject alternative name
IKE SAIKEv2, RSA signatures, AES-256-CBC, SHA-256, DH group 20
IPsec SAESP AES-256-CBC, HMAC-SHA-256-128, PFS group 20; route-based on both ends

What you’ll practise

  • Create a CA and issue identity certificates with OpenSSL, with the right extensions and subject alternative names
  • Import a PKCS#12 bundle into an IOS trustpoint and turn off revocation checking where no CRL exists
  • Load a CA certificate and a local certificate into a vSRX CA profile
  • Configure IKEv2 RSA-signature authentication with FQDN identities on both vendors
  • Read certificates and IKE SAs: show crypto pki certificates, show crypto ikev2 sa detail, show security pki local-certificate
  • Explain why certificates scale better than pre-shared keys, and what a production PKI adds

The tasks

  1. Run the CA
  2. Certificates on HQ
  3. Certificates on SRX-CL
  4. IKEv2 with RSA signatures

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Certificate authentication - an OpenSSL CA for IOS and vSRX5 nodes, 4 links. Every link is listed as text below the diagram.ISPCAHQSRX-CLCL-PCGi0/2eth0ge-0/0/1Gi0/0Gi0/0Gi0/0Gi0/1ge-0/0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to HQ Gi0/0
  • ISP Gi0/1 to SRX-CL ge-0/0/0
  • ISP Gi0/2 to CA eth0
  • SRX-CL ge-0/0/1 to CL-PC Gi0/0
Nodes in Certificate authentication - an OpenSSL CA for IOS and vSRX, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
CAEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
HQCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SRX-CLJuniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB
CL-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 09 - Certificate authentication - an OpenSSL CA for IOS and vSRX and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.