WEBVTT

1
00:00.000 --> 00:01.758 align:middle line:84%


2
00:01.758 --> 00:03.800 align:middle line:90%
In this video, we get to
walk through the process

3
00:03.800 --> 00:06.858 align:middle line:90%
of training a router to become
a certificate authority.

4
00:06.858 --> 00:08.150 align:middle line:84%
Now, why would that be helpful?

5
00:08.150 --> 00:09.942 align:middle line:90%
Well, if you're building
a lab environment,

6
00:09.942 --> 00:12.290 align:middle line:90%
and you don't want to have
to wheel in or get access

7
00:12.290 --> 00:14.450 align:middle line:90%
to a certificate
authority, whether on-prem

8
00:14.450 --> 00:16.760 align:middle line:90%
or on the cloud, you
can train a router

9
00:16.760 --> 00:18.620 align:middle line:84%
to be a certificate authority.

10
00:18.620 --> 00:21.300 align:middle line:90%
You can then have it
authenticate with itself,

11
00:21.300 --> 00:23.650 align:middle line:90%
so it trusts the root
certificate, its own.

12
00:23.650 --> 00:26.150 align:middle line:90%
And then you can have it enroll,
so it gets its own identity

13
00:26.150 --> 00:26.990 align:middle line:84%
certificate.

14
00:26.990 --> 00:30.042 align:middle line:90%
So I'm going to walk you through
that full process right now.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:26.990 --> 00:30.042 align:middle line:90%
So I'm going to walk you through
that full process right now.

15
00:30.042 --> 00:32.000 align:middle line:90%
OK, so the router we're
going to configure here

16
00:32.000 --> 00:36.540 align:middle line:90%
is router 1, and let's go
to the CLI and get to work.

17
00:36.540 --> 00:37.670 align:middle line:84%
All right, so here we go.

18
00:37.670 --> 00:40.250 align:middle line:90%
To create RSA key
pairs, we definitely

19
00:40.250 --> 00:42.630 align:middle line:90%
need to have a
domain name set up.

20
00:42.630 --> 00:44.570 align:middle line:90%
So let's go into
configuration mode,

21
00:44.570 --> 00:48.800 align:middle line:90%
and we'll use the IP domain name
of ogit.online, that'll work.

22
00:48.800 --> 00:51.920 align:middle line:90%
And then we need to
generate a RSA key pair.

23
00:51.920 --> 00:54.920 align:middle line:90%
And so the syntax to
do that is right here.

24
00:54.920 --> 00:59.060 align:middle line:90%
crypto key generate rsa
general-keys modulus 2048,

25
00:59.060 --> 01:01.150 align:middle line:84%
and now it says boom, I'm done.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:59.060 --> 01:01.150 align:middle line:84%
and now it says boom, I'm done.

26
01:01.150 --> 01:04.400 align:middle line:90%
SSH is now available on this
box, because I have a key pair.

27
01:04.400 --> 01:06.240 align:middle line:90%
And if we want to
issue certificates,

28
01:06.240 --> 01:08.660 align:middle line:90%
we can do so via
HTTP, but we have

29
01:08.660 --> 01:10.800 align:middle line:90%
to have the HTTP server
enabled to do that.

30
01:10.800 --> 01:12.860 align:middle line:84%
So we'll do ip http server.

31
01:12.860 --> 01:13.970 align:middle line:84%
That's now enabled.

32
01:13.970 --> 01:15.830 align:middle line:84%
Let's next create a CA server.

33
01:15.830 --> 01:18.125 align:middle line:90%
So crypto pki server,
I'm just going to name it

34
01:18.125 --> 01:19.700 align:middle line:84%
CA so we know what it is.

35
01:19.700 --> 01:23.120 align:middle line:90%
That puts us into crypto
pki server configuration

36
01:23.120 --> 01:24.417 align:middle line:84%
mode for the server.

37
01:24.417 --> 01:26.750 align:middle line:90%
I'm going to add some details
regarding this certificate

38
01:26.750 --> 01:27.350 align:middle line:84%
authority.

39
01:27.350 --> 01:29.040 align:middle line:90%
So I'm going to add this
detail about the issuer name,

40
01:29.040 --> 01:29.998 align:middle line:84%
just so I recognize it.

41
01:29.998 --> 01:33.095 align:middle line:90%
Basically, the common
name is ca.ogit.online,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.998 --> 01:33.095 align:middle line:90%
Basically, the common
name is ca.ogit.online,

42
01:33.095 --> 01:35.720 align:middle line:90%
so if we see that, we'll think,
oh yeah, this is the CA server.

43
01:35.720 --> 01:38.210 align:middle line:90%
Next, because I don't want
to have to go in and manually

44
01:38.210 --> 01:40.010 align:middle line:90%
approve every
certificate request

45
01:40.010 --> 01:42.685 align:middle line:90%
I get, I'm going to use this
command right here, grant auto.

46
01:42.685 --> 01:44.060 align:middle line:90%
That basically
tells your router,

47
01:44.060 --> 01:45.890 align:middle line:90%
hey, you get a
request, boom, you

48
01:45.890 --> 01:48.020 align:middle line:90%
sign that certificate
for that identity,

49
01:48.020 --> 01:49.530 align:middle line:84%
and you just hand it back out.

50
01:49.530 --> 01:51.007 align:middle line:90%
No need to get a
manual approval.

51
01:51.007 --> 01:53.090 align:middle line:90%
And then we're going to
tell it to go ahead and go

52
01:53.090 --> 01:56.007 align:middle line:90%
to work with this command
right here, no shutdown.

53
01:56.007 --> 01:57.590 align:middle line:90%
So it's asking us
to supply a password

54
01:57.590 --> 02:01.000 align:middle line:84%
to protect the private key.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:57.590 --> 02:01.000 align:middle line:84%
to protect the private key.

55
02:01.000 --> 02:02.420 align:middle line:84%
I'll put a password in.

56
02:02.420 --> 02:04.740 align:middle line:90%
I will try to
retype it the same.

57
02:04.740 --> 02:07.380 align:middle line:90%
So generate the keys, this
is for the CA service.

58
02:07.380 --> 02:09.600 align:middle line:90%
And it now says that the
certificate server is now

59
02:09.600 --> 02:10.100 align:middle line:84%
enabled.

60
02:10.100 --> 02:11.120 align:middle line:84%
Fantastic.

61
02:11.120 --> 02:13.190 align:middle line:90%
So now we have a
CA server defined.

62
02:13.190 --> 02:15.670 align:middle line:90%
It's willing to hand out
digital certificates.

63
02:15.670 --> 02:17.330 align:middle line:90%
But what we now
need to do is, we

64
02:17.330 --> 02:18.913 align:middle line:90%
need to go back to
the router and say,

65
02:18.913 --> 02:21.223 align:middle line:90%
OK, now you know that CA
service you have running?

66
02:21.223 --> 02:23.390 align:middle line:90%
You need to go ahead and
trust that root certificate

67
02:23.390 --> 02:24.600 align:middle line:84%
from that CA server.

68
02:24.600 --> 02:26.960 align:middle line:90%
And once you trust it, we
need to get your own identity

69
02:26.960 --> 02:29.390 align:middle line:84%
certificate signed by that CA.

70
02:29.390 --> 02:31.480 align:middle line:90%
Let me walk you through
those steps right now.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:29.390 --> 02:31.480 align:middle line:90%
Let me walk you through
those steps right now.

71
02:31.480 --> 02:33.410 align:middle line:90%
So to define, or
to tell this router

72
02:33.410 --> 02:36.890 align:middle line:90%
that it has a CA server that
it trusts and how to get there,

73
02:36.890 --> 02:40.650 align:middle line:90%
syntax is crypto pki
trustpoint, and then a name.

74
02:40.650 --> 02:43.220 align:middle line:90%
I'm just going to use
LOCAL-CA, in upper case, that's

75
02:43.220 --> 02:45.812 align:middle line:90%
only relevant to this
local router's perspective.

76
02:45.812 --> 02:47.270 align:middle line:90%
So then we need to
specify, OK, how

77
02:47.270 --> 02:48.893 align:middle line:84%
do you reach this CA server?

78
02:48.893 --> 02:50.560 align:middle line:90%
Now, if we were
speaking to it verbally,

79
02:50.560 --> 02:52.057 align:middle line:90%
we could just say,
hey, it's you!

80
02:52.057 --> 02:54.140 align:middle line:90%
But what we'll do is, we'll
specify the enrollment

81
02:54.140 --> 02:59.630 align:middle line:90%
URL of http://1.1.1.1:80,
which is basically TCP port

82
02:59.630 --> 03:02.090 align:middle line:90%
80 at that address,
and that IP address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
02:59.630 --> 03:02.090 align:middle line:90%
80 at that address,
and that IP address

83
03:02.090 --> 03:03.470 align:middle line:84%
is owned by this router.

84
03:03.470 --> 03:05.420 align:middle line:90%
We're going to do
show ip interface

85
03:05.420 --> 03:07.140 align:middle line:84%
brief, just to verify that.

86
03:07.140 --> 03:09.260 align:middle line:90%
And sure enough,
that says Loopback0.

87
03:09.260 --> 03:11.660 align:middle line:90%
So if he needs to reach
out to that CA server,

88
03:11.660 --> 03:13.430 align:middle line:84%
he can do it through this URL.

89
03:13.430 --> 03:16.735 align:middle line:90%
And previously, we enabled HTTP
services, so that's good to go.

90
03:16.735 --> 03:18.110 align:middle line:90%
The other thing
that I want to do

91
03:18.110 --> 03:21.080 align:middle line:90%
is, I want to avoid any
type of revocation checks,

92
03:21.080 --> 03:22.830 align:middle line:90%
because I don't want
it to get in the way.

93
03:22.830 --> 03:24.710 align:middle line:84%
So revocation-check space none.

94
03:24.710 --> 03:26.210 align:middle line:90%
That basically means
we're not going

95
03:26.210 --> 03:29.180 align:middle line:90%
to care about getting a CRL
or checking a CRL, certificate

96
03:29.180 --> 03:30.468 align:middle line:84%
revocation list.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:29.180 --> 03:30.468 align:middle line:84%
revocation list.

97
03:30.468 --> 03:32.510 align:middle line:90%
That's a good thing,
because I didn't create one.

98
03:32.510 --> 03:35.630 align:middle line:90%
We could also create a
CRL on this CA server

99
03:35.630 --> 03:38.012 align:middle line:90%
and put it in the flash,
but I don't have one.

100
03:38.012 --> 03:40.220 align:middle line:90%
I'm just going to tell my,
from a client perspective,

101
03:40.220 --> 03:42.137 align:middle line:90%
I'm going to say don't
bother looking for one.

102
03:42.137 --> 03:45.458 align:middle line:90%
And then we can exit out of
trustpoint configuration mode.

103
03:45.458 --> 03:47.000 align:middle line:90%
So now that we've
trained this router

104
03:47.000 --> 03:49.035 align:middle line:90%
on how to reach
the CA, its own CA,

105
03:49.035 --> 03:50.660 align:middle line:90%
we're now going to
go ahead and tell it

106
03:50.660 --> 03:52.202 align:middle line:84%
to authenticate with that CA.

107
03:52.202 --> 03:53.910 align:middle line:90%
Basically, the
authenticate command says,

108
03:53.910 --> 03:56.990 align:middle line:90%
hey, grab that certificate
from that root CA,

109
03:56.990 --> 03:59.593 align:middle line:90%
and trust it as a
trusted CA certificate.

110
03:59.593 --> 04:01.260 align:middle line:90%
That's what we're
going to do right now.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
03:59.593 --> 04:01.260 align:middle line:90%
That's what we're
going to do right now.

111
04:01.260 --> 04:04.160 align:middle line:90%
So to do that, we are going
to use the command crypto pki

112
04:04.160 --> 04:06.673 align:middle line:90%
authenticate, and then the
name of our CA right here.

113
04:06.673 --> 04:08.090 align:middle line:90%
So when we press
Enter, it's going

114
04:08.090 --> 04:11.990 align:middle line:90%
to reach out to itself,
to its own CA service,

115
04:11.990 --> 04:15.020 align:middle line:90%
and ask for the
root certificate.

116
04:15.020 --> 04:18.269 align:middle line:90%
Now, it's also going to prompt
us, do we want to accept it?

117
04:18.269 --> 04:21.529 align:middle line:90%
And if we do, we say yes,
press Enter, and boom.

118
04:21.529 --> 04:25.005 align:middle line:90%
We now have the certificate
of that trusted CA

119
04:25.005 --> 04:26.700 align:middle line:84%
that we can now use.

120
04:26.700 --> 04:29.360 align:middle line:90%
So if we had three or
four different routers,

121
04:29.360 --> 04:31.693 align:middle line:90%
you could have one router be
your certificate authority,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:29.360 --> 04:31.693 align:middle line:90%
you could have one router be
your certificate authority,

122
04:31.693 --> 04:33.693 align:middle line:90%
and all the other routers
could use this process

123
04:33.693 --> 04:34.550 align:middle line:84%
to check in with it.

124
04:34.550 --> 04:37.190 align:middle line:90%
I'm just saving real estate
by having the same router be

125
04:37.190 --> 04:40.775 align:middle line:90%
its own CA server, and then
authenticating with itself.

126
04:40.775 --> 04:42.150 align:middle line:90%
Now, one question
might be, well,

127
04:42.150 --> 04:43.460 align:middle line:84%
how do we verify those certs?

128
04:43.460 --> 04:47.030 align:middle line:90%
And we could do a show
crypto pki cert, right here,

129
04:47.030 --> 04:48.030 align:middle line:84%
this command.

130
04:48.030 --> 04:50.270 align:middle line:90%
And this is showing
us the CA certificate

131
04:50.270 --> 04:51.510 align:middle line:84%
that we trust, right there.

132
04:51.510 --> 04:57.090 align:middle line:90%
So the issuer is ca.ogit.online,
the subject is ca.ogit.online.

133
04:57.090 --> 04:59.870 align:middle line:90%
So now, if this router ever
received a digital certificate

134
04:59.870 --> 05:02.170 align:middle line:90%
that was signed by this
CA, it would trust it,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
04:59.870 --> 05:02.170 align:middle line:90%
that was signed by this
CA, it would trust it,

135
05:02.170 --> 05:03.710 align:middle line:84%
because it is a trusted CA.

136
05:03.710 --> 05:05.510 align:middle line:90%
Now, the next step
is we want to get

137
05:05.510 --> 05:07.250 align:middle line:90%
an identity certificate
for router 1

138
05:07.250 --> 05:10.220 align:middle line:84%
itself signed by the CA.

139
05:10.220 --> 05:12.770 align:middle line:90%
We'll do that with
the enroll command.

140
05:12.770 --> 05:16.220 align:middle line:90%
And the syntax for that is
right here. crypto pki enroll.

141
05:16.220 --> 05:18.460 align:middle line:90%
So the first command
was to authenticate,

142
05:18.460 --> 05:21.500 align:middle line:90%
and then this is enroll,
and we'll press Enter.

143
05:21.500 --> 05:22.940 align:middle line:90%
So it's asking us
for a password,

144
05:22.940 --> 05:25.010 align:middle line:90%
in case we ever need to
talk to the CA server

145
05:25.010 --> 05:27.150 align:middle line:90%
and have the
certificate revoked.

146
05:27.150 --> 05:30.410 align:middle line:90%
So let's go ahead and
do a password of this,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
05:27.150 --> 05:30.410 align:middle line:90%
So let's go ahead and
do a password of this,

147
05:30.410 --> 05:33.980 align:middle line:84%
and I will confirm that.

148
05:33.980 --> 05:34.710 align:middle line:84%
Great.

149
05:34.710 --> 05:36.710 align:middle line:90%
And it's asking me, hey,
in this certificate I'm

150
05:36.710 --> 05:39.418 align:middle line:90%
about to give you,
says the CA, do you

151
05:39.418 --> 05:41.210 align:middle line:90%
want to include the
router's serial number?

152
05:41.210 --> 05:42.970 align:middle line:84%
And I say, yeah, why not?

153
05:42.970 --> 05:45.470 align:middle line:90%
And then do you want to include
an IP address in the subject

154
05:45.470 --> 05:46.290 align:middle line:84%
name?

155
05:46.290 --> 05:47.433 align:middle line:84%
And hey, why not?

156
05:47.433 --> 05:49.100 align:middle line:90%
And then it's asking
me what IP address?

157
05:49.100 --> 05:52.640 align:middle line:90%
Let's do 15.1.1.1, because
that is my IP address

158
05:52.640 --> 05:54.080 align:middle line:84%
on the outside interface.

159
05:54.080 --> 05:56.460 align:middle line:90%
And finally, now you have
those details specified.

160
05:56.460 --> 05:58.850 align:middle line:90%
Do you want to request the
certificate from the CA?

161
05:58.850 --> 06:02.670 align:middle line:90%
I will say yes, and
survey says it's granted.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
05:58.850 --> 06:02.670 align:middle line:90%
I will say yes, and
survey says it's granted.

162
06:02.670 --> 06:05.240 align:middle line:90%
And that's because we tell
the CA server to automatically

163
06:05.240 --> 06:06.570 align:middle line:84%
grant certificates.

164
06:06.570 --> 06:09.980 align:middle line:90%
We can also verify it with this
command, show crypto pki cert.

165
06:09.980 --> 06:12.380 align:middle line:90%
So here we have our
identity certificate.

166
06:12.380 --> 06:15.470 align:middle line:84%
It was issued by ca.ogit.online.

167
06:15.470 --> 06:18.845 align:middle line:90%
And the subject is
us, R1.ogit.online.

168
06:18.845 --> 06:20.720 align:middle line:90%
There's the IP address
and the serial number,

169
06:20.720 --> 06:22.460 align:middle line:90%
because we said we
want it included.

170
06:22.460 --> 06:25.730 align:middle line:90%
And then below that, we
have the root certificate

171
06:25.730 --> 06:28.940 align:middle line:90%
that we got earlier when we did
the authentication of the CA

172
06:28.940 --> 06:29.532 align:middle line:84%
server.

173
06:29.532 --> 06:30.990 align:middle line:90%
So what have we
done in this video?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

173
06:29.532 --> 06:30.990 align:middle line:90%
So what have we
done in this video?

174
06:30.990 --> 06:33.170 align:middle line:90%
We've enabled CA
services on a router.

175
06:33.170 --> 06:35.450 align:middle line:90%
We authenticated, we
enrolled in preparation

176
06:35.450 --> 06:38.690 align:middle line:90%
for using RSA signatures as
part of the authentication

177
06:38.690 --> 06:40.730 align:middle line:90%
for remote access
VPNs, which we'll

178
06:40.730 --> 06:43.290 align:middle line:90%
continue that discussion
in the next video.

179
06:43.290 --> 06:45.240 align:middle line:90%
I'll see you there
in just a moment.

180
06:45.240 --> 06:47.660 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

181
06:47.660 --> 06:51.040 align:middle line:90%
and I'd like to thank
you for viewing.