Manualshelf

Users Guide

ManualsBrandsDell ManualsAccess PlatformsW-Series Controller AOS
831832833834835836837838839840
Table Of Contents
l Store the certificate in the flash of the RAP
l Store CSR and private key files in a USB
l Delete certificates
l Generate a CSR paired with a private key generation for the RAP. The private key is stored in the flash and
the CSR can be exported out of the RAP to get it signed by the CA.
If there is a custom certificate present in the flash when rebooting, this feature creates a suite B tunnel with the
controller if the certificates uploaded are using EC algorithms. Otherwise it creates a tunnel using standard RAP
IPSec parameters.
Suite-B Support for ECDSA Certificate
If a custom ECDSA certificate is present in the flash of a certificate-based RAP, it is automatically designated as a
Suite-B RAP. On the controller side, tunnel creation uses the server certificate as a default VPN server
certificate.
Administering Suite-B support for a RAP includes these steps which are described in the following sections:
1. Setting the Default Server Certificate
2. Import a custom certificate
3. Generate a Certificate Signing Request (CSR)
4. Upload the certificate
Setting the Default Server Certificate
In the CLI
To set the default server certificate that is presented to the RAP as the default VPN server certificate:
(host) (config) #crypto-local isakmp server-certificate
<server_certificate_name>
To add the CA certificate to verify the RAP certificate:
(host) (config) #crypto-local isakmp ca-certificate <trusted CA>
Importing a Custom Certificate
Certificates can only be imported to the controller using the WebUI.
In the WebUI
1. Navigate to Configuration > Management > Certificates and upload the certificate.
2. To use imported certificates to create a tunnel, navigate to Configuration > Advanced Services >
Emulate VPN Services.
Generating a CSR
The RAP console page allows you to generate a CSR. This is done through a private key which can be generated
and saved to the RAP flash. A corresponding CSR is exported so it can be signed by the required CA to use as
the RAP certificate. This RAP certificate can then be uploaded using the Upload button on the RAP Console
page.
The subject of the RAP certificate needs to be the MAC address of the RAP, and nothing more. Note that this is
case insensitive.
If you create a CSR on the RAP and then have a certificate issued by a CA, you must have the certificate in PEM
format before uploading it to the RAP.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Management Access |
836