User's Manual

Table Of Contents
Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
126
NOTE:
Incoming
CRL traffic
requires administrative
access. If the adminis-
trative IP address ACL
(disabled by default) is
enabled, it must include
IP addresses for CRL.
See Section 2.2.5 for
more detail. Traffic is
affected by the per-
interface packet filters.
If configured, per-inter-
face packet filters must
include filters to permit
CRL traffic to and from
the FMP. See Section
4.6.3 for more detail.
4.2.2.3 Managing the Certificate Revocation List
The global Certificate Revocation List (CRL) function is
enabled by default, as it must be in order for per-function CRL
options to take effect when they are enabled.
When CRL functionality is enabled globally
and for IPsec and/
or internal RADIUS EAP-TLS functions, digital certificates are
checked against the lists of certificates that have been revoked
by their issuing authorities.
Peer certificate chains are traced back to a trusted root
certificate, and each certificate's serial number is checked
against the contents of the issuing authority’s CRL to verify that
none of the certificates in the chain have been revoked, as
described in IETF RFC
1
3280.
CRL locations are commonly embedded in digital certificates.
When such certificates are installed, a Mesh Point enabled for
CRL-checking automatically downloads and uses CRLs from
those locations. You can optionally specify an additional
location for the Mesh Point to check for CRLs.
Manage the local CRL with
set certificate-revocation:
# set certificate-revocation -method crl|none -url
<CRLFileLocation>
-period 120–1440 -
crlMandatory enabled|disabled
NOTE: The IPsec
CRL option is
described in Section
4.4.1. The EAP-TLS CRL
option on the internal
RADIUS server is
described in Section
4.5.2.4.
Indicate the -method of certificate-revocation that will be used
on the Mesh Point, either
crl
or
none
. If -method is
crl
, indicate
the CRL file location (as an HTTP URL) and the update period
in minutes. When
-crlMandatory is enabled, it forces
verification to fail the certificate if the issuing authority's
revocation list is not present or is unreachable. If the
-method
is
crl, -crlMandatory defaults to enabled. If the -method is
none, -crlMandatory is irrelevant.
View current CRL parameters with
show certificate-
revocation
:
> show certificate-revocation
Certificate Revocation
----------------------
Method: crl
Period: 120 minutes
Mandatory: enabled
1. Internet Engineering Task Force Request for Comments