| 6.6 |  | Configure Site-to-Site IPSec VPN using Digital Certificates |
| 6.6.3 |  | Task 2 - configure CA support |

| This section presents a detailed explanation of the steps necessary to configure CA support on routers. Some planning steps and their associated commands are as follows: Step 1 Manage the non-volatile RAM (NVRAM) memory usage This step is optional. In some cases, storing certificates and Certificate Revocation Lists (CRLs) locally does not present a problem. However, in other cases, memory might become an issue. This is especially true if the CA supports an RA and a large number of CRLs are stored on the router.

Step 2 Set the router time and date
The router must have an accurate time and date to enroll with a CA server.

Step 3 Configure the router hostname and domain name
The hostname is used in prompts and default configuration filenames. The domain name is used to define a default domain name that the Cisco IOS software uses to complete unqualified hostnames.

Step 4 Generate an RSA key pair
RSA keys are used to identify the remote VPN peer. Administrators can generate one general-purpose key or two special purpose keys.

Step 5 Declare a CA
To declare the CA, use the

crypto ca trustpoint global configuration command. Use the no form of this command to delete all identity information and certificates associated with the CA.

Step 6 Authenticate the CA
The router needs to authenticate the CA. It does this by obtaining the CA self-signed certificate that contains the CA public key.

Step 7 Request a certificate
Complete this step to obtain a router identity certificate from the CA.

Step 8 Save the configuration
After configuring the router for CA support, the configuration should be saved.

Step 9 Monitor and maintain CA interoperability (Optional)
The following steps are optional, depending on network requirements:

- Request a CRL.
- Delete the router RSA keys.
- Delete both public and private certificates from the configuration.
- Delete the peer public keys.

Step 10 Verify the CA support configuration
The commands detailed in this section allow and verify any configured CA certificates

| Lab Activity e-Lab Activity: Configure CA Support In this activity, students will learn how to configure Cisco IOS CA support.

| Media Activity Demonstration Activity: CA Support with Microsoft Certificate Server In this activity, students will be allowed to configure the routers in the pod to support a Certificate Authority (CA).