IPsec VPN support for third-party certificates

FortiExtender now is able to use third-party CA certificates at phase 1 to verify identity of peers and to establish IPsec VPN tunnels.

Import third-party certificates

Import a third-party CA certificate:

• From the Console: execute vpn certificate ca import tftp <remote_file> <local_name> <ip>
• From the GUI: Click VPN>VPN Certificate>CA Certificate>Import New Certificate.

Import a third-party Local certificate

• From the console: execute vpn certificate local import tftp <remote_file> <local_name> <ip> <passwd>
• From the GUI: Click VPN>VPN Certificate>Entity Certificate>Import New Certificate.

Use third-party certificates for IKE authentication

In 4.2.0, two new fields "certificate" and "peer" have been added to the phase1 interface entry. You can use them to reference the imported third-party certificates. It is important to know that these fields are available only when "authmethod" is set to signature.

Certificate

You can reference the datasource "vpn.certificate.local".

For the name of local signed personal certificates, you can enter the names of up to four signed personal certificates for the FortiExtender unit. You must have the certificated already installed on the FortiExtender beforehand to be able to enter them here.

Peer

You can reference the datasource "vpn.certificate.ca".

This is the name of the CA certificate used to constrain that the peer certificate is issued by it or its sub-CA. The certificates must have already been installed on the FortiExtender before you are able to enter them here.

If the peer is not set, the peer certificate can still be accepted as long as a CA certificate that can verify the peer certificate exists.

Example for using third-party certificates for IKE authentication

config vpn ipsec phase1-interface
    edit vpn1
        set ike-version 2
        set keylife 86400
        set proposal aes128-sha256 aes256-sha256 3des-sha256 aes128-sha1 aes256-sha1 3des-sha1
        set dhgrp 14 5
        set interface nas1
        set type static
        set remote-gw 192.168.137.106
        set authmethod signature
        set certificate <local_cert_name>   ==> new field
        set peer <ca_cert_name>             ==> new field
        set localid 
        set peerid 
    next
end