Import Signed Request with airSlate SignNow

Import signed request

hello and welcome to Cisco aasa training 101 my name's Don Crawley I'm from sound training dotnet with the Seattle washington-based publisher of learning resources and provider of accelerated training for IT professionals this time we're installing a VPN certificate and this is actually any digital identity certificate we're going to focus on VPN because this is a companion video to another video where we have on actually setting up a remote access VPN but what we're going to show you here will work for any type of digital identity certificate this video is the companion to chapter 8 in my book The Accidental administrator Cisco is a security appliance the book is not required for the video but if you'd like to get a copy I'd love for you to have one and it's available from Amazon and other resellers or online at our bookstore at sound training dotnet slash bookstore Ras a software version is 9.11 and the ast M version is 7.1 but if you're using a fairly recent version maybe it's not 9.11 maybe it's 8.4 the procedures are going to be very similar and so you should find this video valuable and helpful in setting of your VPN here's the network diagram for the exercise you're going to need a management work station at 192.168.1 o 1.2 connected via both Ethernet and serial console cable to an a sa the one I'm using is a 5505 but you can use any a sa for this it needs to be configured with the inside and outside addresses as you see in the diagram and then you'll also need a connection to the public internet as well here are the specific software requirements as we mentioned a cisco a sa 5500 5 or 10 20 40 50 security appliance with a base license you'll need one computer serving as a management workstation connected to the inside interface on the a sa including java support in your browser a console cable connected to the serial port on the management workstation and the console port on the a SA and terminal emulation software such as putty you could also use secure CRT or tera term or even hyper terminal for what we're doing here I'm going to use putty prerequisites in order to do this exercise you need to have some comfort working in the command line environment really whether it's Cisco Unix Linux even the Windows PowerShell doesn't matter but you're going to be typing some commands and so it's helpful to have done that before also you'll need unrestricted privilege mode access to a Cisco AAS a security appliance here's a summary of the steps there's really just five you'll generate a new RSA key pair you'll generate the certificate signing request also known as a CSR you'll upload the CSR to a certificate authority also known as a CA you'll wait for the CA to send the certificate how long that takes depends on the CA sometimes it's a matter of a few minutes and other times it's a matter of a few days and maybe they need to verify who you are again that just depends on the certificate authority once you get the certificate back from the CA you'll install it on the a SA and you'll be done here's your disclaimer this videos provided solely as a courtesy to you our viewer there no guarantees whatsoever do not attempt these procedures on a production firewall without first testing them for security and suitability in a lab environment performing these procedures may open your firewall to the public Internet and subject your network to attack so make sure you have current backups and take precautions including data encryption and additional access controls to protect sensitive data so let's do the demo first thing we're going to do is we're going to generate the RSA key pair and we're going to do that in the command line environment then we'll switch over to the ASTM and I'll tell you I make decisions about whether to use the CLI or the GUI based solely on whichever is easier and I don't really care one way or the other this particular task is easier to do in the command line and so that's why we're going to do it here all right so let's go into the configuration mode on the firewall with a command configure terminal will abbreviate that conf a ste and we'll use the crypto family of commands will do crypto key generate RSA label didja cert dot key modulus 2048 let me explain what this means I'll go ahead and get it started doing the generation of the key while I explain it because this will take a couple of minutes first of all crypto invokes the cryptographic family of commands cryptographic services key simply means that we're going to generate a crypto key or get information about it generate means will generate the key RSA is the key type labeled it was just a text string we're going to attach to the key so we know what it means and in this case we're going to call it didja cert key the reason that I chose digit cert key is because we're going to use digit cert as the certificate authority there are many different certificate authorities I'm not recommending them in particular but they do offer a 30-day trial which is why I chose to use them for this demonstration the modulus is the key length and our key length that we're using is 2048 bits now when you do that when you make a change if you have the ASTM open it's going to whine about it and so here it is complaining about changes made to the running-config not in the ASTM so it wants us to refresh it and we'll go ahead and do that now and then we'll go back to the command line environment for a couple of commands I want to show you so we're let it refresh and we'll go back to the CLI so once again we're in the CLI let's just show you the key that we just generated so we're going to use the command show crypto key my pub oops my pub key and RSA so it's going to show us all of our RSA keys there's a default key pair and then there's the one that we just generated so here we go there's the default and at the bottom you can see the one we just generated notice where it says at the top default RSA key for the key name and then toward the bottom it says key name is digit cert key that's the one we just generated will touch the spacebar to continue and there they are that's kind of handy now let's go back to the GUI to the ASTM adaptive security device manager and let's finish the exercise here so let's go to configuration and we're going to come down to device management and we're going to come up to certificate management we're going to choose identity certificates and we're going to come over and choose add we'll choose add a new identity certificate we will choose our new key pair that we just generated digit cert key now let's come here under common name let's complete it so what it really wants here is a fully qualified domain name a and fqdn so let's do a sa zero one that's just the host name on the a SA that I gave it and then we'll complete it with sound training dotnet and we're going to go ahead and click on add certificate notice that it gives you a preview of the CLI commands I actually configure my AST M to do that under tools preview commands it's kind of a handy thing to do maybe yours desert doesn't but I like to see that so that I can learn more the command line commands this is a handy way to do that we'll click on send it whereas for a moment now it's offering to save the CSR to a file so let's do that let's calc click on browse and I like to keep it on my desktop it's just easier to do it that way so we'll call this digit cert key txt click on save as click on OK and here it says the CSR was saved successfully and we'll click on OK to get out of that now let's go take a look at it go to my desktop and we'll open this up just to take a look at it but it's more than just taking a look at it because we need to copy it because we're going to go to the digit cert website and I'm going to do that offline you don't need to watch me go through all that and I'll paste it into a form on the digits or website so we'll use a control a to select all control C to copy and then I'm going to go to the digit cert website you'll go to your CA whatever that is whether it's in trust or Komodo or Verisign or or digits or whomever and follow their instructions for submitting a certificate signing request then they will ultimately email you back the signed certificates and you'll upload those to the firewall now what I'm going to do is I'm going to go to digit cert I'm going to upload this and then I'll wait for the signed certificates back and I'll show you how to upload those into your firewall so it took about 20 minutes four-digit sir to respond and that's going to vary from one certificate authority to the next so just you'll have to wait for however long it takes we did have to do some confirmation we got an email wanting to confirm that we're in control of that particular domain name sound training dotnet and I confirm that but all total about 20 minutes so now let's go ahead and install the certificates and we're going to have to install two we're going to have to install an intermediate or change certificate file four-digit cert and then we'll install the asam training net certificate file as well so we'll start with CA certificates over on the left hand side of the ast and we're going to select CA certificates then we're going to choose add we'll choose to install from a file and then we'll browse to the location where we downloaded the certificates from digit cert and we're going to choose the digit cert CA now you can't see it but it has a dot CRT extension and that's just a certificate file so we'll go ahead and choose that click on install and then we'll come down to the bottom and choose install certificate there's the certificate itself and we'll click on send and the certificate was installed successfully now you may or may not see the preview of the commands that it's sending to the a SA that just depends on how you got your ASTM configured but as I mentioned earlier I kind of like to do that we'll click on OK now we have to install the identity certificate for a sa zero one dot sound training dotnet so we're going to click on identity certificates we're going to select the certificate that we generated earlier this is where we actually generated the private keys and now we're going to come over and choose the install button click on install and once again it asks to install from a file so we're going to browse to our old buddies where we had them before and there is a sa zero one underscore sound training underscore net we'll click on install IDs certificate file and installs certificate same thing as before previewing the command and the certificate import was successful we'll click on OK and now if we take a look up here you can see that the associated trust points are there the usage is described as general purpose and the public key type is the RSA 2048-bit key that we set up and if you look over here see who is issued to and issued by digit cert so we're all set and in our next video I'll show you how to associate this certificate with a remote access VPN if you'd like more information we've got lots of online resources for you visit our website at wwlp.com training net / blog and in fact you can find these procedures detailed in a blog post at my blog you can subscribe to our newsletter at sound training net / newsletter follow us on facebook twitter and google+ if you'd like more videos they're available on our video channel at www.engvid.com training net I'm Don Crawley I'll see you next time