smunro622
join:2006-02-15
Madison Heights, MI
| PKI _VS_CA
I am looking into additional security for our vpn, we currently use rsa and not renewing our contract as the cost of fobs and maintenance.
We are implementing 2 form authentication with sms notification from ldap, if you cell number isnt in the list your do not get it. We want to add a certificate with our vpn users also. We currently have a asa 5510 w/aip and 8.2 running. I am looking for pros and cons of this, users are connecting via cisco vpn, or the OSX 10.6 built in cisco client. If we go the cert route who issues these, geotrust? verisign? Can someone please point me in the right direction please |
|
elnino
join:2006-08-27
Akron, OH
| For certs, you can either use public ones like Geotrust or Verisign but most people probably set up an internal CA server on their network like Microsoft or Entrust. With Microsoft, you can issue new certs for free and with Entrust you are allocated X amount and once you hit that limit, you buy more. |
|
kamikatze
join:2007-11-02 | reply to smunro622
Don't forget about OpenSSL either.
»sial.org/howto/openssl/ca/ |
|
keeska
Premium
join:2007-04-06
Sedona, AZ | reply to smunro622
Don't forget the CA built into IOS. Depending on the number of certificates you will be issuing this may be a good option. |
|
