Lab cấu hình Windows server 2003 làm CA Server

[danghoangkhanh]

Lab cấu hình Windows server 2003 làm CA Server

Tác giả: Vi Thị Mưu

Mô hình như sau:

Các thiết bị bao gồm: 2 Router 2800, 1 Switch 3550, 1 Windows server 2003

Client 1:
Router#config terminal
Router(config)#hostname client1
Client1(config)# interface f0/1
Client1(config-if)# ip address 172.30.2.2 255.255.255.0
Client1(config-if)# no shut
Client1(config-if)# exit
Client1(config)# interface f0/1
Client1(config-if)# ip address 192.168.1.2 255.255.255.0
Client1(config-if)# no shut
Client1(config-if)# exit
# cấu hình domain name cho Router
Client1(config)# ip domain-name cisco.com
Client1(config)# ip host caserver 172.30.1.2
# cấu hình trustpoint
Client1(config)# crypto ca trustpoint CA
Client1(ca-trustpoint)# enrollment url http://172.30.1.2/certsrv/mscep/mscep.dll
Client1(ca-trustpoint)# subject-name cn=client1@vnpro.org
Client1(ca-trustpoint)# exit
Client1(config)# crypto ca authenticate CA
#cấu hình VPN
Client1(config)# crypto isakmp policy 10
Client1(config-isakmp)# hash md5
Client1(config-isakmp)# exit
Client1(config)# crypto ipsec transform-set myset esp-des esp-md5-hmac
Client1(config-crypto-trans)# exit
Client1(config)# crypto map mymap 10 ipsec-isakmp
Client1(config-crypto-map)# set peer 172.30.3.2
Client1(config-crypto-map)# set transform-set myset
Client1(config-crypto-map)# match address 101
Client1(config-crypto-map)# exit
Client1(config)# access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
# áp crypto map vào cổng
Client1(config)# interface f0/1
Client1(config-if)# crypto map mymap
Client1(config-if)# exit
Client1(config)#

Client 2:
Router#config terminal
Router(config)#hostname client1
Client2(config)# interface f0/1
Client2(config-if)# ip address 172.30.3.2 255.255.255.0
Client2(config-if)# no shut
Client2(config-if)# exit
Client2(config)# interface f0/1
Client2(config-if)# ip address 192.168.2.2 255.255.255.0
Client2(config-if)# no shut
Client2(config-if)# exit
# cấu hình domain name cho Router
Client2(config)# ip domain-name cisco.com
Client2(config)# ip host caserver 172.30.1.2
# cấu hình trustpoint
Client2(config)# crypto ca trustpoint CA
Client2(ca-trustpoint)# enrollment url http://172.30.1.2/certsrv/mscep/mscep.dll
Client2(ca-trustpoint)# subject-name cn=client1@vnpro.org
Client2(ca-trustpoint)# exit
Client2(config)# crypto ca authenticate CA
#cấu hình VPN
Client2(config)# crypto isakmp policy 10
Client2(config-isakmp)# hash md5
Client2(config-isakmp)# exit
Client2(config)# crypto ipsec transform-set myset esp-des esp-md5-hmac
Client2(config-crypto-trans)# exit
Client2(config)# crypto map mymap 10 ipsec-isakmp
Client2(config-crypto-map)# set peer 172.30.2.2
Client2(config-crypto-map)# set transform-set myset
Client2(config-crypto-map)# match address 101
Client2(config-crypto-map)# exit
Client2(config)# access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
# áp crypto map vào cổng
Client2(config)# interface f0/1
Client2(config-if)# crypto map mymap
Client2(config-if)# exit
Client2(config)#

Cấu hình CAServer :
Các bước cấu hình Windows server 2003 làm CA
để xây dựng 1 CA ta làm như sau:
Bước1: cài đặt dịch vụ IIS
Để cài được dịch vụ CA tr ên windowns server 2003 ta cần có IIS :
1. vào start--> control panel-->add or remove programs
2. Trong add or remove programs, nhấn add/remove windowns components
3. nhấn vào application server (nhưng không tích vào ô chọn)

--> chọn detail

4. Tích vào Internet Information Service (IIS)

5. Nhấn Next --> finish để hoàn thành cài đặt

Bước 2: cài đặt dịch vụ CA
1. vào start-->control panel--> add or remove program
2. trong mục add or remove program, nhấn add/remove windowns components
3. Tích vào o certificates services

4. lúc này nhận được thong báo về việc không thay đổi tên máy tính
--> chọn yes

5. Trong CA type --> chọn Stand-alone root CA -->next

6. Trong mục Common name for this CA, nhấp vào tên máy tính đang cài đặt
giả sử đang cài trên máy C0111

7. Để mặc định nơi lưu trữ database và log file của CA --> nhấn Next

8. sau khi nhấn Next ta nhận được thông báo phải dừng Internet Information Service --> chọn Yes

9. sau khi nhấn Yes xuất hiện yêu cầu File I386 --> chọn thư mục có chứa file I386 --> OK

10. Trong quá trình hoàn thành cài đặt, nhận được thông báo --> chọn Yes

11. Nhấn finish để hoàn thành cài đặt

Bước 3: để hoàn thành được CA, ta cài thêm phần SCEP
11. Nhấn finish để hoàn thành cài đặt

2. sau đó click Next --> chọn use the local system account

3. Nhấn Next --> và bỏ chọn require SCEP challenge Phrase to enroll

4. Nhấn Next --> chọn Yes và điền thông tin

5. Nhấn Next --> finish để hoàn thành

[danghoangkhanh]

KIểm tra hoạt động:

Thực hiện đối với client1 :

Client1# show run
Building configuration...
Current configuration : 3484 bytes
!
! Last configuration change at 17:39:57 UTC Tue Apr 1 2008
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname client1
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
ip cef
!
ip domain name cisco.com
ip host caserver 172.30.1.2
!
multilink bundle-name authenticated
!
!
voice-card 0
no dspfarm
!
crypto pki trustpoint CA
enrollment mode ra
enrollment url http://172.30.1.2:80/certsrv/mscep/mscep.dll
subject-name cn=client2@vnpro.org
revocation-check none
!
crypto pki certificate chain CA
certificate ca 2AE3AB73C8740484449E6747E831C315
3082035E 30820246 A0030201 0202102A E3AB73C8 74048444 9E6747E8 31C31530
0D06092A 864886F7 0D010105 0500300D 310B3009 06035504 03130243 41301E17
0D303830 34303131 30303733 305A170D 31333034 30313130 31373039 5A300D31
0B300906 03550403 13024341 30820122 300D0609 2A864886 F70D0101 01050003
82010F00 3082010A 02820101 00CBA99B 66BE2E13 686D17E1 78F65707 ED7FC5BB
8B185DFC ACB0528C 98E34EA1 D8740992 3BCA5499 0F4560D0 FC812612 86F32EE4
BE2C9F25 8B1E1559 48105CF4 2BA982F1 25796414 F2B0C807 6E674F3C 26570EE5
6F3B8050 8A9F2B04 950053E5 F5E89D83 3F845E55 B8FC417A 7E928666 93DE60C0
16B17729 AF9D47C2 B2F38BC9 5A0A9BDC 8F082F5D 9E1A1C52 F38E527C D3675A51
172C6B22 8D50D782 CD7DFF60 0894C803 D4E383E1 59512FFD A94B6A1B 0E20D5FF
19AFDBBA 19557ECE BD6AD9C7 3A291286 6BB769E2 732C4077 4DC8C494 03EC5B28
BD54E9F7 A99FBD6F 1C16D9F5 250F6130 3E84A20A A3DDBB0F 047B83E8 3FE45FE8
088B6F2E 61846DBE 97DD7FAA 73020301 0001A381 B93081B6 300B0603 551D0F04
04030201 86300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E041604
14ED3F97 C57AB992 26BAFC48 4E7BD3C9 E85BF544 0A306506 03551D1F 045E305C
305AA058 A0568628 68747470 3A2F2F74 6F2D7A6E 6A6E346F 36726F30 34682F43
65727445 6E726F6C 6C2F4341 2E63726C 862A6669 6C653A2F 2F5C5C74 6F2D7A6E
6A6E346F 36726F30 34685C43 65727445 6E726F6C 6C5C4341 2E63726C 30100609
2B060104 01823715 01040302 0100300D 06092A86 4886F70D 01010505 00038201
01001E07 FB20C734 7FD7D5F4 C2164304 CCBC2F51 3F3D7DBA DBAD3574 C2825357
942BD488 4B83150F 434DC673 164E5819 F508E271 EBF9F4CC 57775094 7C9A1D60
44CE7B0B EC0498CD 96487BF9 8611577C F82DAE85 9FFC14B6 825706BA 0B3B0A9E
C9DA0A44 F02C2657 D3299546 46F9B79B 24005242 23177BA1 B368EA26 9FF33103
5C25436D 89439014 41158A39 D527AEF0 327EDA5B 2D58179B C4845291 7346E26B
D15CEEE0 54FEC609 E6AC91A1 81391F7F C1C89D2A 62DDFFE5 A160B233 ED3AC12D
109FF62E 6A753A64 821EDE52 CB4CEBE2 EBCC9E76 1C67E1E2 771EACBA 1588B9CF
FFD5FEBA 12336A71 8A8FD10C 4FA62140 31476CD7 AAFF8529 E76E9AE8 A0BA5E50 0112
quit
!
!
crypto isakmp policy 10
hash md5
!
crypto ipsec transform-set myset esp-des esp-md5-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer 172.30.3.2
set transform-set myset
match address 150
!
interface FastEthernet0/0
ip address 192.168.1.2 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 172.30.2.2 255.255.255.0
duplex auto
speed auto
crypto map mymap
!
interface Serial0/1/0
no ip address
shutdown
clock rate 2000000
!
ip route 0.0.0.0 0.0.0.0 172.30.2.1
!
ip http server
no ip http secure-server
!
access-list 150 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
privilege level 15
no login
!
scheduler allocate 20000 1000
!
end

Thực hiện đối với client2

Client2# show run
Building configuration...

Current configuration : 5774 bytes
!
! Last configuration change at 17:23:41 UTC Tue Apr 1 2008
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname client2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
ip domain name cisco.com
ip host caserver 172.30.1.2
!
!
voice-card 0
!
crypto pki trustpoint CA
enrollment mode ra
enrollment url http://172.30.1.2:80/certsrv/mscep/mscep.dll
subject-name cn=client1@vnpro.org
revocation-check none
!
crypto pki certificate chain CA
certificate 618FFBFC000000000004
308203C4 308202AC A0030201 02020A61 8FFBFC00 00000000 04300D06 092A8648
86F70D01 01050500 300D310B 30090603 55040313 02434130 1E170D30 38303430
31313031 3031335A 170D3039 30343031 31303230 31335A30 3E312030 1E06092A
864886F7 0D010902 1311636C 69656E74 322E6369 73636F2E 636F6D31 1A301806
03550403 1411636C 69656E74 3140766E 70726F2E 6F726730 5C300D06 092A8648
86F70D01 01010500 034B0030 48024100 A480B3CC 2C27F772 EB3411DB 2E7A8330
F4FBF6BE 235F7BEC AFD201A0 CD47A95F 7F12D3F1 0BF60369 02F58108 2A5EFB2F
6BD89DF6 45ADF27D AE5D40B9 6D53A193 02030100 01A38201 BB308201 B7300B06
03551D0F 04040302 05A0301D 0603551D 0E041604 14CF2761 D9851558 F31FF702
235D9E31 5CEF87CF 71301F06 03551D23 04183016 8014ED3F 97C57AB9 9226BAFC
484E7BD3 C9E85BF5 440A3065 0603551D 1F045E30 5C305AA0 58A05686 28687474
703A2F2F 746F2D7A 6E6A6E34 6F36726F 3034682F 43657274 456E726F 6C6C2F43
412E6372 6C862A66 696C653A 2F2F5C5C 746F2D7A 6E6A6E34 6F36726F 3034685C
43657274 456E726F 6C6C5C43 412E6372 6C30819E 06082B06 01050507 01010481
9130818E 30440608 2B060105 05073002 86386874 74703A2F 2F746F2D 7A6E6A6E
346F3672 6F303468 2F436572 74456E72 6F6C6C2F 746F2D7A 6E6A6E34 6F36726F
3034685F 43412E63 72743046 06082B06 01050507 3002863A 66696C65 3A2F2F5C
5C746F2D 7A6E6A6E 346F3672 6F303468 5C436572 74456E72 6F6C6C5C 746F2D7A
6E6A6E34 6F36726F 3034685F 43412E63 7274301F 0603551D 110101FF 04153013
8211636C 69656E74 322E6369 73636F2E 636F6D30 3F06092B 06010401 82371402
04321E30 00490050 00530045 00430049 006E0074 00650072 006D0065 00640069
00610074 0065004F 00660066 006C0069 006E0065 300D0609 2A864886 F70D0101
05050003 82010100 31B97667 A8E4D0D6 B4F5083D C552F2DD 1E7E08B3 FBC46B10
8D4C4F96 04C77623 BF17A57B 5AE15975 234A64FF 1FBD376B 2D39D4B0 7C2F2187
F4F545AB E8ED233B CA13AB1E 23025DF7 98CD8222 E82E0FB8 72EEA354 FB841224
4A954CC6 598A15B6 45BB7AF6 2B88279F 0F18C771 E18D5C39 AEF719FC 036B19B3
0ADFFEE5 E896497C 520A7D64 B3FFD626 3C54AABD 523459B1 47E59401 AF4415E2
37A80E47 BE957700 392EAD42 EBE82BF2 B03F1875 33D91B6C 5C40FF8E 4C606499
A4B8B173 47CE6653 DA897A58 1C5A8514 699A793F 95147CE5 E4036BC3 FCF0E795
6B758C4D EC6FB390 60AE43B1 393B6CF9 B9D959AB 09B94067 102991D6 69640739
2AEEF189 780A64DF
quit
certificate ca 2AE3AB73C8740484449E6747E831C315
3082035E 30820246 A0030201 0202102A E3AB73C8 74048444 9E6747E8 31C31530
0D06092A 864886F7 0D010105 0500300D 310B3009 06035504 03130243 41301E17
0D303830 34303131 30303733 305A170D 31333034 30313130 31373039 5A300D31
0B300906 03550403 13024341 30820122 300D0609 2A864886 F70D0101 01050003
82010F00 3082010A 02820101 00CBA99B 66BE2E13 686D17E1 78F65707 ED7FC5BB
8B185DFC ACB0528C 98E34EA1 D8740992 3BCA5499 0F4560D0 FC812612 86F32EE4
BE2C9F25 8B1E1559 48105CF4 2BA982F1 25796414 F2B0C807 6E674F3C 26570EE5
6F3B8050 8A9F2B04 950053E5 F5E89D83 3F845E55 B8FC417A 7E928666 93DE60C0
16B17729 AF9D47C2 B2F38BC9 5A0A9BDC 8F082F5D 9E1A1C52 F38E527C D3675A51
172C6B22 8D50D782 CD7DFF60 0894C803 D4E383E1 59512FFD A94B6A1B 0E20D5FF
19AFDBBA 19557ECE BD6AD9C7 3A291286 6BB769E2 732C4077 4DC8C494 03EC5B28
BD54E9F7 A99FBD6F 1C16D9F5 250F6130 3E84A20A A3DDBB0F 047B83E8 3FE45FE8
088B6F2E 61846DBE 97DD7FAA 73020301 0001A381 B93081B6 300B0603 551D0F04
04030201 86300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E041604
14ED3F97 C57AB992 26BAFC48 4E7BD3C9 E85BF544 0A306506 03551D1F 045E305C
305AA058 A0568628 68747470 3A2F2F74 6F2D7A6E 6A6E346F 36726F30 34682F43
65727445 6E726F6C 6C2F4341 2E63726C 862A6669 6C653A2F 2F5C5C74 6F2D7A6E
6A6E346F 36726F30 34685C43 65727445 6E726F6C 6C5C4341 2E63726C 30100609
2B060104 01823715 01040302 0100300D 06092A86 4886F70D 01010505 00038201
01001E07 FB20C734 7FD7D5F4 C2164304 CCBC2F51 3F3D7DBA DBAD3574 C2825357
942BD488 4B83150F 434DC673 164E5819 F508E271 EBF9F4CC 57775094 7C9A1D60
44CE7B0B EC0498CD 96487BF9 8611577C F82DAE85 9FFC14B6 825706BA 0B3B0A9E
C9DA0A44 F02C2657 D3299546 46F9B79B 24005242 23177BA1 B368EA26 9FF33103
5C25436D 89439014 41158A39 D527AEF0 327EDA5B 2D58179B C4845291 7346E26B
D15CEEE0 54FEC609 E6AC91A1 81391F7F C1C89D2A 62DDFFE5 A160B233 ED3AC12D
109FF62E 6A753A64 821EDE52 CB4CEBE2 EBCC9E76 1C67E1E2 771EACBA 1588B9CF
FFD5FEBA 12336A71 8A8FD10C 4FA62140 31476CD7 AAFF8529 E76E9AE8 A0BA5E50 0112
quit
!
!
crypto isakmp policy 10
hash md5
!
crypto ipsec transform-set myset esp-des esp-md5-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer 172.30.2.2
set transform-set myset
match address 150
!
!
interface FastEthernet0/0
ip address 192.168.2.2 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 172.30.3.2 255.255.255.0
duplex auto
speed auto
crypto map mymap
!
interface Serial0/1/0
no ip address
shutdown
no fair-queue
clock rate 2000000
!
ip route 0.0.0.0 0.0.0.0 172.30.3.1
!
!
ip http server
no ip http secure-server
!
access-list 150 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
!
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
privilege level 15
no login
!
scheduler allocate 20000 1000
end

client2# show crypto ca certificates
Certificate
Status: Available
Certificate Serial Number: 618FFBFC000000000004
Certificate Usage: General Purpose
Issuer:
cn=CA
Subject:
Name: client2.cisco.com
cn=client1@vnpro.org
hostname=client2.cisco.com
CRL Distribution Points:

http://to-znjn4o6ro04h/CertEnroll/CA.crl

Validity Date:
start date: 10:10:13 UTC Apr 1 2008
end date: 10:20:13 UTC Apr 1 2009
Associated Trustpoints: CA

CA Certificate
Status: Available
Certificate Serial Number: 2AE3AB73C8740484449E6747E831C315
Certificate Usage: Signature
Issuer:
cn=CA
Subject:
cn=CA
CRL Distribution Points:

http://to-znjn4o6ro04h/CertEnroll/CA.crl

Validity Date:
start date: 10:07:30 UTC Apr 1 2008
end date: 10:17:09 UTC Apr 1 2013
Associated Trustpoints: CA

Thực hiện Ping từ PC 2 đến PC 1 kiểm tra kết nối

+ kết quả là 2 PC đã kết nối được với nhau.

[tranmyphuc]

Chào!!!
Với CA server do mình tạo ra chỉ có thể dùng chứng thực trong mạng nội bộ. Nếu dùng để gởi nhận mail thông qua Internet hoặc giao dịch thương mại (https://) các bạn cần phải thuê một CA server quốc tế như Verisign chẳng hạn

Chúc các bạn vui !!!

[freetudo]

Excellence course