SRX

Hi,

I’m looking to create a VPN between 2 SRX devices. I want to use self signed certificates to authenticate the VPN.

Does anyone know the procedure for this?
#SRX

Self signed certificate will not work with certificate based VPN as it does not have trust level. You need external CA certifcate and it should be loaded on both SRX. You can configure your own local CA server on Windows Server or Linux and requests certificate from it or use certificate from Well known public CA certificate ($$$) . 

 

 

 

 

Thanks for the reply,

I’m really trying to avoid using our main CA for this one, is there anyway I can use one of these SRX devices as the CA and sign itself and the other SRX?

So in effect, one SRX is the CA and they both get signed that way?

Thanks

SRX can not be configured as root CA server to sign certificate request.

 

Can I create a self signed certificate and simply export the public key out to the other SRX?

Then do the same on the other SRX so essentially each SRX has the others public key to create trust?

I remember old Cisco world could do this ... thanks

I personally use the XCA tool for all internal certifcate signing. IF you are sure these SRX's do not need to use the certificate with any external machine, you may setup your own CA with the XCA tool.

Thanks for that.

Just to confirm, is that this tool:
https://sourceforge.net/projects/xca/

Can I export self signed certificates to this and then manage signing them between multiple SRX firewalls?

Don’t suppose you have anymore literature for this?

Thanks

Yup, that's the one. I don't see a point in exporting self-signed certs into it.

 

What you can do is:

1. Setup a Root CA on the tool

2. Setup intermediates (which won't be necessary for your setup AFAIK)

3. Create certificate requests on both SRX boxes, export them to the tool and get them signed with the CA you set up

4. Export the certs and load them on individual SRX-es, along with the CA cert

5. Configure your VPNs

 

I don't have any guide for XCA, but it it a very simple to use GUI. It uses OpenSSL in the backend, powerful, easy to use.

(If you are a linux person, forget XCA - you can directly use OpenSL CLI 🙂 )

Feel free to share screenshots if you run into any trouble.

Thanks very much

You are Welcome - and thanks for the Kudos! 🙂

Keep us posted on how it goes.