Download Down - Digi-Key

Redundancy
Adding a new CA certificate to identify VPN partners
The FL MGUARD can be set to authenticate VPN partners using CA certificates (see "CA
certificates" on page 6-124 and "Authentication" on page 6-186).
To do this, select Signed by any trusted CA under IPsec VPN >> Connections >> Edit
>> Authentication / Remote CA Certificate .
With this setting, a new CA certificate can be added without affecting the established VPN
connections. However, the new CA certificates are used immediately. The X.509 certificate
used by the VPN partner to authenticate itself to the FL MGUARD can then be replaced with
minimal interruption. The only requirement is ensuring that the new CA certificate is
available first.
The FL MGUARD can be set to check the validity period of the certificates provided by the
VPN partner (see "Certificate settings" on page 6-120). In this case, new trusted CA
certificates must be added to the FL MGUARD configuration. These certificates should also
have a validity period.
If the CRL check is activated (under Authentication >> Certificates >> Certificate settings ),
one URL (where the corresponding CRL is available) must be maintained for each CA
certificate. The URL and CRL must be published before the FL MGUARD uses the CA
certificates in order to confirm the validity of the certificates shown by the VPN partners.
Using X.509 certificates with limited validity periods and CRL checks
The use of X.509 certificates is described under "Certificate settings" on page 6-120
(Authentication >> Certificates >> Certificate settings menu).
If X.509 certificates are used and Check the validity period of certificates and CRLs is
set, the system time has to be correct. We recommend synchronizing the system time using
a trusted NTP server. Each FL MGUARD in a redundant pair can use the other as an
additional NTP server, but not as the only NTP server.
8334_en_01
PHOENIX CONTACT
7-25