Virtual PrivateNetworks(VPN) IPsec
IX20 User Guide
539
15. Set the number of daysthat the certificate enrollment can be renewed, prior to the request
expiring. This value is configured on the SCEPserver, and is used by the IX20 device to
determine when to start attempting to auto-renew an existing certificate. Thedefault is 7.
(config network scep_client scep_client_name)> renewable_time integer
(config network scep_client scep_client_name)>
16. (Optional) Enable verbose logging in /var/log/scep_client:
(config network scep_client scep_client_name)> debug true
(config network scep_client scep_client_name)>
17. Save the configuration and apply the change
(config network scep_client scep_client_name)> save
Configuration saved.
>
18. Typeexit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection
menu. Type quit to disconnect from the device.
Example: SCEP client configuration with Fortinet SCEP server
In this example configuration, we will configure the IX20 device as a SCEPclient that will connect to a
Fortinet SCEPserver.
Fortinet configuration
On the Fortinet server:
1. Enable ports for SCEPservices:
a. From the menu, select Network >Interfaces.
b. Select the appopriate port and click Edit.
c. For Access Rights>Services, enable the following services:
n
HTTPS>SCEP
n
HTTPS>CRL Downloads
n
HTTP >SCEP
n
HTTP >CRL Downloads
d. The remaining fields can be left at their defaults or changed as appropriate.
e. Click OK.
2. Create a Certificate Authority (CA):
a. From the menu, click Certificate Authorities> Local CAs.
b. Click Create New.
c. Typea Certificate IDfor the CA, for example, fortinet_example_ca.
d. Complete the Subject Information fields.
e. The remaining fields can be left at their defaults or changed as appropriate.
f. Click OK.
To Next Page
Loading...
Need help?
General