Cisco ASR 1004 User Manual

Page 38 of 72
4.6.4.3 Authenticating the Certificate Authority
The TOE must authenticate the CA by acknowledging its attributes match the publicly posted
fingerprint. The TOE administrator must verify that the output of the command below matches
the fingerprint of the CA on its public site.
1. Authenticate the CA: crypto ca authenticate trustpoint-name
Device (config)#crypto ca authenticate ciscotest
Certificate has the following attributes:
Fingerprint MD5: 8DE88FE5 78FF27DF 97BA7CCA 57DC1217
Fingerprint SHA1: 271E80EC 30304CC1 624EEE32 99F43AF8 DB9D0280
% Do you accept this certificate? [yes/no]: yes
Trustpoint CA certificate accepted.
4.6.4.4 Storing Certificates to a Local Storage Location
Certificates are stored to NVRAM by default; however, some routers do not have the required
amount of NVRAM to successfully store certificates. All Cisco platforms support NVRAM and
flash local storage. Depending on the platform, an authorized administrator may have other
supported local storage options including bootflash, slot, disk, USB flash, or USB token. During
run time, an authorized administrator can specify what active local storage device will be used to
store certificates. For more detailed information see the Public Key Infrastructure Configuration
Guide Guidance document section "How to Configure PKI Storage." -
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_pki/configuration/xe-3s/sec-pki-xe-
3s-book.pdf
4.6.4.4.1. How to Specify a Local Storage Location for Certificates
The summary steps for storing certificates locally to the TOE are as follows:
1. Enter configure terminal mode:
Device # configure terminal
2. Specify the local storage location for certificates: crypto pki certificate storage
location-name
Device(config)# crypto pki certificate storage flash:/certs
3. Exit:
Device(config)# exit
4. Save the changes made:
Device# copy system:running-config nvram:startup-config
5. Display the current setting for the PKI certificate storage location:
Device# show crypto pki certificates storage
The following is sample output from the show crypto pki certificates storage command, which
shows that the certificates are stored in the certs subdirectory of disk0:
Device# show crypto pki certificates storage
Certificates will be stored in disk0:/certs/

Cisco ASR 1004 Specifications

General

Product Type	Router
Form Factor	Rack-mountable
Rack Height	2U
Forwarding Capacity	Up to 20 Gbps
Total Number of Ports	Varies by configuration
Number of Total Expansion Slots	4
Product Series	ASR 1000
Model	ASR 1004
Forwarding Performance	Up to 20 Gbps
Operating System	Cisco IOS XE
Power Supply	Dual
Route Processor	ASR 1000 Series Route Processor
Network Interface Modules	SFP, SFP+, Gigabit Ethernet, 10 Gigabit Ethernet
Interfaces/Ports	Varies by configuration
Expansion Slot Type	SPA
Throughput	20 Gbps
Redundancy	Power supply, Route Processor
Interfaces	Gigabit Ethernet, 10 Gigabit Ethernet, SFP, SFP+
Storage	Up to 64 GB Flash