| 14.8 |  | Scaling PIX Security Appliance VPNs |
| 14.8.2 |  | Enroll a PIX Security Appliance with a CA |

| Peers go through a series of steps in order to enroll with a CA server. In this process, specific keys are generated and then exchanged by the PIX Security Appliance and the CA server to ultimately form a signed certificate. The enrollment steps can be summarized as follows:

1. The PIX Security Appliance must create an RSA key pair:

   > ca generate rsa keykey_modulus_size

2. The PIX Security Appliance is configured to work with a CA:

   > ca identity ca_nickname ca_ipaddress [ca_script_location] [ldap_ip address]

   > ca configure ca_nickname ca| ra retry_period retry_count [crloptional]

   > ca authenticate ca_nickname [fingerprint]

3. The PIX Security Appliance requests a signed certificate from the CA using the generated RSA keys and the public key certificate from the CA server:

   > ca enroll ca_nickname challenge_password [serial] [ipaddress]

4. The CA administrator verifies the request and sends a signed certificate.

| Lab Activity e-Lab Activity: Configure Cisco PIX Security Appliance for CA Support (RSA Signatures) In this lab activity, the student will configure a secure VPN gateway using IPSec between two PIX Security Appliances using digital certificates.

| Lab Activity Lab Exercise: Configure IPSec between Two PIX Security Appliances with CA support In this lab exercise, the student will complete the following tasks:

- Configure CA support on a PIX Security Appliance.
- Configure IKE phase one and phase two using RSA signatures for authentication between two PIX Security Appliances.
- Test and verify IPSec configuration.