|
Posted by Brian Komar on February 1, 2008, 11:46 am
Please log in for more thread options
The certificates are used to authenticate the two endpoints, not to encrypt
data
Since it is for authentication, digital signing makes perfect sense
Brian
> Hi there,
>
> I set up a lab with the following components:
>
> 1 AD CS 2008 stand alone CA = IPSECCA1
> 2 vista clients = IPSECPC1, IPSECPC2
> WORKGROUP
>
> I set up my vista clients to use an IPsec policy, and I thought that the
> kind of cert I should issue from my CA was one having to do with IPSEC, or
> IKE authentication.
>
> I would issue a certificate and then turn on the policy on each client
> (the policy was the same on each one), and see if I could do a ping test.
>
> It turned out, through process of elimination that I needed to issue a
> digital signing cert.
>
> Can anyone explain that to me?
>
> My Ip Policy on the vista clients was a very basic policy which included:
>
> my IP filter list included ANY (source, dest etc
> filter action was to negotiate security based on the default method
> preference order, integrity and encryption (data will be encrypted and
> verified as authentic and unmodified)
> This was not for a tunnel endpoint
> my authentication method was set to: use a cert from this CA: CN=IPSECCA1
>
>
> Thanks for your thoughts in advance,
>
> Kristin
>
| 
XML Sitemap