Summary

As the scale of enterprise-class IPSec VPN designs increases, so do the design challenges associated with the scalability and management of the overall architecture. In this chapter, we've introduced the use of a PKI as a centralized, scalable resource for key management in large-scale IPSec VPN deployments. The PKI lends an additional degree of security to the overall IPSec VPN architecture using a centralized, trusted resource (the PKI CA) to distribute public key certificates to each IPSec VPN gateway participating in the PKI. At this point, we have discussed how Cisco IPSec VPN gateways using RSA signatures for IKE Authentication authenticate and enroll with the CA of the PKI, obtain their public key certificates, and verify each other's public key certificates using several different design alternatives including:

• Standalone CA deployments

• CA deployments using one or more RAs

• CA hierarchies using multiple CAs for redundancy

We have also covered the basics for using PKI technology with Cisco IPSec VPN endpoints, and several design alternatives to deploying PKI resources. PKIs should be evaluated as the design option of choice using concepts and design scenarios discussed in this chapter when additional levels of secure, scalable key management are required within their IPSec VPN deployments.