R3166-R3206-HP High-End Firewalls VPN Configuration Guide-6PW101

161
Figure 89 Apply RSA digital signature in IKE negotiation
2. Configuration procedure
a. Configure Firewall A
# Configure the entity DN.
<FirewallA> system-view
[FirewallA] pki entity en
[FirewallA-pki-entity-en] ip 2.2.2.1
[FirewallA-pki-entity-en] common-name Firewalla
[FirewallA-pki-entity-en] quit
# Configure the PKI domain. The URL of the registration server varies with the CA server.
[FirewallA] pki domain 1
[FirewallA-pki-domain-1] ca identifier CA1
[FirewallA-pki-domain-1] certificate request url
http://1.1.1.100/certsrv/mscep/mscep.dll
[FirewallA-pki-domain-1] certificate request entity en
[FirewallA-pki-domain-1] ldap-server ip 1.1.1.102
# Set the registration authority to RA.
[FirewallA-pki-domain-1] certificate request from ra
# Configure the CRL distribution URL. This is not necessary if CRL checking is disabled.
[FirewallA-pki-domain-1] crl url ldap://1.1.1.102
[FirewallA-pki-domain-1] quit
# Create a local key pair using RSA.