Yeslab現任明教教主 階層化PKI試驗筆記

試驗拓撲：

<a href="http://photo.blog.sina.com.cn/showpic.html#blogid=52ddfea30100vmtz&amp;url=http://s1.sinaimg.cn/orignal/52ddfea3ga79fe13beaf0" target="_blank"></a>

<a href="http://blog.51cto.com/attachment/201110/193130224.png" target="_blank"></a>

================================下面是階層化PKI配備份==================================

hostname Root-CA

!

boot-start-marker

boot-end-marker

no aaa new-model

memory-size iomem 5

clock timezone GMT 8

ip cef

ip domain name yeslab.net

ip auth-proxy max-nodata-conns 3

ip admission max-nodata-conns 3

multilink bundle-name authenticated

crypto pki server Root-CA

issuer-name cn=Root-CA.yeslab.net, ou=yeslabsec, o=yeslab, l=qygy701

grant auto

crypto pki trustpoint Root-CA

revocation-check crl

rsakeypair Root-CA

crypto pki certificate chain Root-CA

certificate ca 01

30820281 308201EA A0030201 02020101 300D0609 2A864886 F70D0101 04050030

54311030 0E060355 04071307 71796779 37303131 0F300D06 0355040A 13067965

736C6162 31123010 06035504 0B130979 65736C61 62736563 311B3019 06035504

03131252 6F6F742D 43412E79 65736C61 622E6E65 74301E17 0D313130 37303930

37353434 345A170D 31343037 30383037 35343434 5A305431 10300E06 03550407

13077179 67793730 31310F30 0D060355 040A1306 7965736C 61623112 30100603

55040B13 09796573 6C616273 6563311B 30190603 55040313 12526F6F 742D4341

2E796573 6C61622E 6E657430 819F300D 06092A86 4886F70D 01010105 0003818D

00308189 02818100 B5782222 B5436C90 C4985C3D 8390DBEC DF15C731 B00E1A1C

1DC9C402 B934BF58 5AFD094C 069A197B 01C6D422 3788AE6D E896D690 3D1A0E71

8CF5FCED E07B573C 6C0B4182 A4CE5B83 3C0F9488 FB7F7F26 E70B0D0F C6F2622A

FC735257 B9302D91 F4432CA4 7CA82009 97863F23 55E827AB 22CC6BB9 EBF156A3

1E5232E2 834549D9 02030100 01A36330 61300F06 03551D13 0101FF04 05300301

01FF300E 0603551D 0F0101FF 04040302 0186301F 0603551D 23041830 16801475

126334D2 A442A3A9 7308348C A8A39094 ED00CC30 1D060355 1D0E0416 04147512

6334D2A4 42A3A973 08348CA8 A39094ED 00CC300D 06092A86 4886F70D 01010405

00038181 009BDB04 2635EC7B 68FE949E 43DD952A FB628504 9369AA2F 20127CE4

AB25DA16 A3212311 13811C36 E58AF0D7 E65830E4 9CC8B772 F3CB62B0 0B1C9121

3306B6F8 C925639D 3FA316C5 8D038546 BA61A550 77348027 75E20E9D CEB1498A

32646D8A 103AB928 9CD16E28 B4D6DC13 C1D7A7DC CF5DD3E1 46655B80 9A3D5C2A

39D9F90B 86

quit

! 

archive

log config

hidekeys

interface FastEthernet0/0

ip address 10.1.1.200 255.255.255.0

duplex auto

speed auto

interface FastEthernet0/1

no ip address

shutdown

interface FastEthernet1/0

interface FastEthernet2/0

interface FastEthernet3/0

ip http server

no ip http secure-server

ip forward-protocol nd

control-plane

line con 0

line aux 0

line vty 0 4

ntp master

end

=====================================================================================

hostname SUB-CA-1

crypto pki server SUB-CA-1（再配置SUB-CA）

issuer-name cn=SUB-CA-1.yeslab.net, ou=yeslabsec, o=yeslab, l=qygy701

mode sub-cs

crypto pki trustpoint SUB-CA-1（先配置Trustpoint）

enrollment url http://10.1.1.200:80

subject-name cn=SUB-CA-1.yeslab.net, ou=yeslabsec, o=yeslab, l=qygy701

rsakeypair SUB-CA-1

crypto pki certificate chain SUB-CA-1

certificate 02

3082027F 308201E8 A0030201 02020102 300D0609 2A864886 F70D0101 04050030

38303034 305A170D 31323037 30383038 30303430 5A305531 10300E06 03550407

55040B13 09796573 6C616273 6563311C 301A0603 55040313 13535542 2D43412D

312E7965 736C6162 2E6E6574 30819F30 0D06092A 864886F7 0D010101 05000381

8D003081 89028181 00E8EA7B DA3C2BB7 DAC3B4C0 777D4FA7 5A97529B B0056605

88142FCF BFED261A CE92B1A7 B3AE026F 5587A7E8 8187A844 8E5B488E 79AFF9EF

5B5E5D9F 3885292F 2C05320C 9248EE72 9D347EAF 157BF220 510D04F3 4B9FA924

856BD6ED C2D27272 47F7356D B62C5AF2 2CF21F16 96D86ED9 F5D455F2 2DAD83CC

F6351188 913329FB DF020301 0001A360 305E300F 0603551D 130101FF 04053003

0101FF30 0B060355 1D0F0404 03020780 301F0603 551D2304 18301680 14751263

34D2A442 A3A97308 348CA8A3 9094ED00 CC301D06 03551D0E 04160414 9DC56EC1

4B6C16C3 9D993F30 BCE7D5F5 AFB59140 300D0609 2A864886 F70D0101 04050003

818100AD 33C2DFA3 C62F8F88 FC0E3BC1 93C0546D 6DCE2552 E266B50D 9EB9B23B

5DBCBCB4 362C7F17 CFB7D9CF 2C43A045 1FA90D59 0D028536 24268254 1BCFACF2

14204679 F4BB1C9A B10B870D 70363950 F13E976E 3D8C2E9B CBA73BA0 43FD2063

0425F20E 3E030A2A 3FB0074F B4341DD2 9635BE27 7D17341C F5B0639C DB287EC0

0797B6

ip address 10.1.1.201 255.255.255.0

ntp clock-period 17179832

ntp server 10.1.1.200

==============================================================================

hostname SUB-CA-2

crypto pki server SUB-CA-2（再配置SUB-CA）

issuer-name cn=SUB-CA-2.yeslab.net, ou=yeslabsec, o=yeslab, l=qygy701

crypto pki trustpoint SUB-CA-2（先配置Trustpoint）

subject-name cn=SUB-CA-2.yeslab.net, ou=yeslabsec, o=yeslab, l=qygy701

rsakeypair SUB-CA-2

crypto pki certificate chain SUB-CA-2

certificate 03

3082027F 308201E8 A0030201 02020103 300D0609 2A864886 F70D0101 04050030

38303334 305A170D 31323037 30383038 30333430 5A305531 10300E06 03550407

322E7965 736C6162 2E6E6574 30819F30 0D06092A 864886F7 0D010101 05000381

8D003081 89028181 00CD7427 073403A1 1DFDE953 7D89429A 32A9EEFC A91D33FE

D885B918 0DEF3F78 011F371B FE08A046 02E31DDF F05BCAA4 797D61ED 74152889

57F5F737 65981D55 D9BD4D00 EB537F62 E7104B67 50B93DBD 3F5A870B 386FCE08

CC4DB429 1D53BE19 60A77ADB 7C989BC0 FC7E29B3 FAB000DD 2ED50B9E 5284C58F

1D0146B6 FFF3B86B 07020301 0001A360 305E300F 0603551D 130101FF 04053003

34D2A442 A3A97308 348CA8A3 9094ED00 CC301D06 03551D0E 04160414 5A8D795A

BB7D8FC8 0C966384 B9FE8EB6 7967890E 300D0609 2A864886 F70D0101 04050003

8181000F 3A6ABB70 1E1A3D7C ACADA943 07379F4D 31524AFA 26903DEC CAFC11EB

B14E8CED 264AB684 BBC08081 0B1849DA A189EBC7 6BEFD441 08945C93 6631D4A8

F33B336E 8BEF837B 0B85864A F06DFE49 9F24A360 F208750E 321DADDF BB604ED8

E83805D1 A4E8BB2D 3FBB47E0 6DD908E5 34D6879D 0F72F8DE 0050D1A3 ADC1AD98

EDB785

ip address 10.1.1.202 255.255.255.0

ntp clock-period 17179842

===========================================================================

hostname Hub

--------------------此部分可以替換-------------------

crypto pki trustpoint SUB-CA-1

enrollment url http://10.1.1.201:80

serial-number

crypto pki trustpoint SUB-CA-2

enrollment url http://10.1.1.202:80

--------------------替換後配置-----------------------

revocation-check none

30820209 30820172 A0030201 02020103 300D0609 2A864886 F70D0101 04050030

55311030 0E060355 04071307 71796779 37303131 0F300D06 0355040A 13067965

736C6162 31123010 06035504 0B130979 65736C61 62736563 311C301A 06035504

03131353 55422D43 412D312E 7965736C 61622E6E 6574301E 170D3131 30373039

30383132 33395A17 0D313230 37303830 38303034 305A3033 31313012 06035504

05130B4A 41423034 34364330 4C32301B 06092A86 4886F70D 01090216 0E487562

2E796573 6C61622E 6E657430 5C300D06 092A8648 86F70D01 01010500 034B0030

48024100 9E318197 42885081 BE140E64 61EE4490 9FB87A66 E3BEC1E4 7A7186FB

8367B340 31514481 D531E266 F339979C E98D5CE2 5EEF27CD 406C6C8C 709ED667

C8D27139 02030100 01A34F30 4D300B06 03551D0F 04040302 05A0301F 0603551D

23041830 1680149D C56EC14B 6C16C39D 993F30BC E7D5F5AF B5914030 1D060355

1D0E0416 0414A119 3E1FB82F 90DBC2BF 788E492B 7028BB5C 09A9300D 06092A86

4886F70D 01010405 00038181 00025616 454D4FC5 3BA50495 2AC82E18 42F5CA40

0ED14685 385FB013 E7C306E3 3377D76E 70DDB319 8F30CF40 32498F98 51B36229

0F0C773E FA4E3603 17422BDB 1DB3043E 392D402C 1071DA98 A1EE8151 5F078694

B382E574 50AC6FC2 CFF0D626 E13A27D4 2192E022 8E7C68FD 227A476E A6DC5742

41C786ED DCB8E4A9 15CDF9BE B0

certificate ca 02

30820209 30820172 A0030201 02020102 300D0609 2A864886 F70D0101 04050030

03131353 55422D43 412D322E 7965736C 61622E6E 6574301E 170D3131 30373039

30383038 35335A17 0D313230 37303830 38303334 305A3033 31313012 06035504

23041830 1680145A 8D795ABB 7D8FC80C 966384B9 FE8EB679 67890E30 1D060355

4886F70D 01010405 00038181 00C8FA45 DD9479DF A81BC0A2 7C5DA77A 81578795

8698C7F1 836BE82D 38D03CCC E3B1DD44 A203EF17 5C1C3130 5F2DE8B8 78FFCC62

76313308 8A9B5058 65C37797 98872F0A 62F09252 86DF872A F2C667B1 AFB0B9D0

33A2D4D4 AFFF8728 28C86AA4 C4806796 9908C780 90D7E652 EBA3C7C0 782F41D6

535B24AF 7EF6A08C D84CF202 2F

certificate ca 03

crypto isakmp policy 10

crypto ipsec transform-set cisco esp-des esp-md5-hmac

crypto map cisco 10 ipsec-isakmp

set peer 10.1.1.1

set transform-set cisco

match address hub-spoke1

crypto map cisco 20 ipsec-isakmp

set peer 10.1.1.2

match address hub-spoke2

ip ssh version 1

interface Loopback0

ip address 192.168.100.1 255.255.255.0

ip address 10.1.1.100 255.255.255.0

crypto map cisco

no ip http server

ip route 192.168.1.1 255.255.255.255 10.1.1.1

ip route 192.168.2.1 255.255.255.255 10.1.1.2

ip access-list extended hub-spoke1

permit ip host 192.168.100.1 host 192.168.1.1

ip access-list extended hub-spoke2

permit ip host 192.168.100.1 host 192.168.2.1

ntp clock-period 17179850

=======================================================================

hostname Spoke-1

revocation-check none（嚴重注意：在Spoke上根證書伺服器吊銷檢查要為none）

subject-name cn=new-spoke-1-final

rsakeypair new-spoke1

certificate 09

3082026D 308201D6 A0030201 02020109 300D0609 2A864886 F70D0101 04050030

30393130 33395A17 0D313230 37303830 38303034 305A3053 311A3018 06035504

0313116E 65772D73 706F6B65 2D312D66 696E616C 31353012 06035504 05130B4A

41423034 34364330 4C32301F 06092A86 4886F70D 01090216 1253706F 6B652D31

00308189 02818100 AFC7B8A6 40752939 8A7BA352 305A1B29 08D25018 3F343701

9FB21747 FBBA835C 490FAE8A 261B9005 8375F260 7E838F4C ACAEECB5 46FF5560

CF36317C 94D19109 47101377 C30151FC FB25A494 5B0FCBD8 EA71128A AAC01704

983E52C5 83A19758 DB7D2308 B533283D 7B3D7D77 4B1F8483 08351858 1219533B

4870A83C 24BB1F57 02030100 01A34F30 4D300B06 03551D0F 04040302 05A0301F

0603551D 23041830 1680149D C56EC14B 6C16C39D 993F30BC E7D5F5AF B5914030

1D060355 1D0E0416 0414AE68 240F8199 4A434539 CE3181A4 8DCD5BFE BC8A300D

06092A86 4886F70D 01010405 00038181 000391FF 7B67E8B2 A1A287F9 9934BCB5

2897C5BD 9F64A7DB F871CD7B 8E6A99EF 1F2CF64B 4FDF9568 18BCA27A 7511F1B2

8906A345 59CE5193 8F85E66D 28CE0688 B3046AB4 32E976ED A545DBE1 6E903159

C719731D A63837FA ECDD8FD0 53017AD7 42B9C898 F73338D9 4E9FC8F4 4BE18F08

0502432A 369CB0BD EE97E388 BBE3E58F 19

set peer 10.1.1.100

match address spoke1-hub

match address spoke1-spoke2

ip address 192.168.1.1 255.255.255.255

ip address 10.1.1.1 255.255.255.0

ip route 192.168.100.1 255.255.255.255 10.1.1.100

ip access-list extended spoke1-hub

permit ip host 192.168.1.1 host 192.168.100.1

ip access-list extended spoke1-spoke2

permit ip host 192.168.1.1 host 192.168.2.1

ntp clock-period 17179876

====================================================================

hostname Spoke-2

subject-name cn=new-spoke-2-final

rsakeypair new-spoke2

certificate 05

3082026D 308201D6 A0030201 02020105 300D0609 2A864886 F70D0101 04050030

30393130 35345A17 0D313230 37303830 38303334 305A3053 311A3018 06035504

0313116E 65772D73 706F6B65 2D322D66 696E616C 31353012 06035504 05130B4A

41423034 34364330 4C32301F 06092A86 4886F70D 01090216 1253706F 6B652D32

00308189 02818100 D1A82221 898AE3EF 1B04DAF0 4C95508C 09740B16 9F87352B

E49BB0EF F616EF54 BAE42E5A 34F61096 0783E4B3 1D372D48 68F79AD5 551C7D3B

450E221D ED680FD9 33E92FF2 2FF09B2E D7064D1A EF70C78C 844D6766 FCA462AD

C12BF828 260B91EC 6A2FEF12 FFA2DADE 12C75337 65E6AFCF 2A2E7188 4EA501E5

4F9A3621 A3F9A697 02030100 01A34F30 4D300B06 03551D0F 04040302 05A0301F

0603551D 23041830 1680145A 8D795ABB 7D8FC80C 966384B9 FE8EB679 67890E30

1D060355 1D0E0416 0414D501 DA59FE8D F8630471 216E9B78 8E8D9E79 9EA8300D

06092A86 4886F70D 01010405 00038181 00BB75DD 9D1CCA09 29EBF40B E4434BEA

2E580DA4 C8657141 CEA47A34 C473ECFA DC1A6DB9 1C15F6AB C775D8C4 A329244A

B409167D 3A69A731 484A091B 460C996F 583BDBD9 B0D5AB2C 04007861 A62105DF

D4DE7B85 4CA09EA4 EC7749A5 ADFEE4E3 ACAFCFD8 2D0A6DC5 CF1D1A3B 53EEF11C

DA6D9B85 BFD8F036 641CD922 6B69BEFF AA

match address spoke2-hub

match address spoke2-spoke1

ip address 192.168.2.1 255.255.255.255

ip address 10.1.1.2 255.255.255.0

ip access-list extended spoke2-hub

permit ip host 192.168.2.1 host 192.168.100.1

ip access-list extended spoke2-spoke1

permit ip host 192.168.2.1 host 192.168.1.1

ntp clock-period 17179864

本文轉自Yeslab教主 51CTO部落格，原文連結:http://blog.51cto.com/xrmjjz/686415