
VMware, Inc. 49
Chapter 5 vShield Edge Management
<department>Engg</department>
<city>Pune</city>
<state>MH</state>
<country>IN</country>
<keySize>1024</keySize>
</csrParams>
</certificateStoreConfig>
</vshieldEdgeConfig>
ThecallreturnsaCSR,whichyousendtothecertifyingauthority(CA),whoreturnsasecuritycertificate.
Add X.509 Certificate as VPN Site
1 Generateacertificatesigningrequest(CSR).
2 HavetheCSRcertifiedbyacertificateauthority(CA).AlsogetthecertificateofthisCA(caCertificate).
3UploadthecaCertificateandthevShieldEdgecertificate.
Example 5-32. Upload security certificates
POST https://<vsm-ip>/api/2.0/networks/<network-ID>/edge
<vshieldEdgeConfig xmlns="vmware.vshield.edge.2.0">
<certificateStoreConfig>
<caCertificate>...enter_text_here...</caCertificate>
<certificate>...enter_text_here...</certificate>
</certificateStoreConfig>
</vshieldEdgeConfig>
4Whenusingx.509authenticationmode,theglobalConfigshouldhavecertificateCnspecified.
5Addthesiteconfigurationtoanexistingsitewiththisrequestbody.
Example 5-33. Add site certificates
<vshieldEdgeConfig xmlns="vmware.vshield.edge.2.0">
<ipsecSiteToSiteConfig>
<globalConfig>
<id>10.112.2.50</id>
<certificateCn>up.vmware.com</certificateCn>
<ipAddress>10.112.2.50</ipAddress>
<enableLog>false</enableLog>
</globalConfig>
<siteConfig>
<peerName>site1</peerName>
<peerId>site1</peerId>
<peerIpAddress>10.112.2.145</peerIpAddress>
<localSubnet>192.168.10.0/24</localSubnet>
<peerSubnet>192.168.20.0/24</peerSubnet>
<authenticationMode>psk</authenticationMode>
<preSharedKey>test</preSharedKey>
<encryptionAlgorithm>3des</encryptionAlgorithm>
<enablePfs>true</enablePfs>
<dhGroup>dh2</dhGroup>
</siteConfig>
<siteConfig>
<peerName>site2</peerName>
<peerId>up.vmware.com</peerId>
<peerIpAddress>10.112.2.148</peerIpAddress>
<localSubnet>192.168.30.0/24</localSubnet>
<peerSubnet>192.168.40.0/24</peerSubnet>
<authenticationMode>x.509</authenticationMode>
<encryptionAlgorithm>aes</encryptionAlgorithm>
<mtu>1500</mtu>
</siteConfig>
</ipsecSiteToSiteConfig>
Comentários a estes Manuais