Scaling Cisco VPNs with MCS

How to use Microsift certificate services to scale a Cisco VPN

Scaling Cisco VPNs with MCS
Tom Lancaster

One of the preferred ways to handle authentication of a large number of VPN tunnels is by using a Certificate Authority or CA. While some organizations prefer to use an external company like Entrust for CA services, others prefer to setup their own CA, which can be very cost effective. The trade-off of course, is that they have to maintain the server and software.

Naturally, Microsoft's Certificate Services is a popular choice for many companies, but it does have a quirk, I mean "feature", that can cause problems in Cisco routers that don't have a lot of memory. This feature revolves around Microsoft's use of Registration Authorities, which act much like a proxy server for the CA. They require both IPSec peers to have the CA and RA public keys. This in turn means that the Cisco router must store it's own certificate, the CA's certificate and two Registration Authority certificates, along with multiple Certificate Revocation Lists. Because these certificates, CRLs and other VPN related information are all stored in a router's NVRAM, which is typically quite small, they can become problematic if they grow too large.

One solution to this problem is to have the router request certificates and CRLs from an external device instead of storing them locally. While this allows you to scale and ensures you won't be constrained by an old router's memory, it also means you need to make sure your CA and RA are as available and reliable as your VPN.

To configure a Cisco router to request this information from a CA or RA, use the command

crypto ca certificate querry

If you want a really elegant solution, you can use an LDAP server (e.g. Active Directory) instead. To tell the Cisco router to request the information from an LDAP server, use the CA-config command

querry url <url>


Thomas Alexander Lancaster IV is a consultant and author with over ten years experience in the networking industry, focused on Internet infrastructure.


This was first published in May 2002

Dig deeper on Network Hardware

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchSDN

SearchEnterpriseWAN

SearchUnifiedCommunications

SearchMobileComputing

SearchDataCenter

SearchITChannel

Close