Configuring the Calling ISA Server Firewall/VPN Gateway to use EAP/TLS Certificate Authentication – Part 1

In part 1 of this article we’ll go over the following steps:

• Join the answering VPN gateway to the internal network domain
  
• Install an enterprise Microsoft Certificate Authority on the internal network and configure the CA to use the Router (Offline) certificate template
  
• Assign a machine certificate to the answering VPN gateway using the Certificates MMC or Group Policy-based autoenrollment

Let’s get started!

The answering VPN gateway needs to be a member of an Active Directory domain. Standalone Windows 2000/Windows Server 2003 computers cannot accept certificates from calling routers for authentication. The best way to address this issue is to make the ISA Server firewall/VPN gateway a member of the internal network domain on the internal network.

However, you can join the ISA Server firewall/VPN gateway to any domain if you prefer not to expose the internal network domain to any risks that might result from compromising the firewall. In this case, the ISA Server firewall/VPN gateway belongs to a domain that all the firewalls belong to and the certificate is obtained from an enterprise CA installed in this domain. The user account that maps to the router’s certificate is configured in this domain instead of the internal network domain.

In this article the answering VPN gateway is a member of the internal network domain.

You can perform the following steps if you have already installed a Microsoft enterprise Certificate Server on your internal network:

1. Click Start point to Administrative Tools and click on Certification Authority. In the Certification Authority console, expand you server name (figure 1).
   
2. Right click on the Certificate Templates node in the left pane of the console, point to New and click on Certificate Template to Issue (figure 2).

Figure 2 (fig2)

3. Select the Router (Offline request) certificate template in the Enable Certificate Templates dialog box (figure 3). Click OK.

4. The Router (Offline request) certificate template now appears in the right pane of the Certification Authority console (figure 4). The calling VPN gateway will now be able to obtain a router certificate from the enterprise Certificate Server using the Web enrollment site.

Close the Certification Authority console.

The answering VPN gateway needs a machine certificate so that it can create the L2TP/IPSec connection with the calling router. The machine certificate allows the answering VPN gateway to identify itself to the calling VPN gateway. In addition, the Certificate Server’s CA certificate is automatically placed in the Trusted Root Certification Authorities node in the answering VPN gateways machine certificate store.

In this example we’ll go over how to use the Certificates MMC snap-in to request and install the machine certificate on the answering ISA Server firewall/VPN gateway. Please refer to the articles mentioned above for more information on how to use Web enrollment and autoenrollment to issue certificates.

Perform the following steps to assign the machine certificate to the answering VPN gateway using the Certificates snap-in.

1. Click Start then click the Run command. Type mmc in the Open text box and click OK. Click the File menu in the Console1 console and click the Add/Remove Snap-in command (figure 5)
   
2. Click the Add button in the Add/Remove Snap-in dialog box (figure 6).
   
3. In the Add Standalone Snap-in dialog box, click the Certificates snap-in and click Add (figure 7).
   
4. Select the Computer account option on the This snap-in will always manage certificates for page (figure 8). Click Next.

5. Select the Local computer option on the Select the computer you want this snap-in to manage page (figure 9). Click Finish.
   
6. Click Close on the Add Standalone Snap-in dialog box (figure 10).
   
7. Click OK on the Add/Remove Snap-in dialog box (figure 11).
   
8. In the Console1 console, Right click on the Certificates node, point to All Tasks and click Request New Certificate (figure 12).

9. Read the information on the Welcome to the Certificate Request Wizard page and click Next (figure 13)
   
10. Click on the Computer certificate template in the Certificate types list on the Certificate Types list (figure 14). Click Next.

11. Provide an easy to read name in the Friendly name text box and include an optional description in the Description text box on the Certificate Friendly name and Description page (figure 15). Click Next.
    
12. Click Finish on the Completing the Certificate Request Wizard page (figure 16).
    
13. Click OK on the Certificate Request Wizard dialog box informing you that the request was successful (figure 17).

The answering VPN gateway now has a computer certificate, and the Certificate Server’s Root CA certificate is in the Trusted Root Certification Authorities node in the machine certificate store on this computer.

Perform the following steps to confirm that the Root CA certificate is in the trusted root store:

1. Click on the Personal\Certificates node in the left pane of the console. Double click on the computer certificate located in the right pane (figure 18).

2. Click on the Certification Path tab on the Certificate dialog box (figure 19). You see the Root CA on the top of the list and the friendly name of this machine’s computer certificate on the bottom. The Root CA in this example is ISAROOT. It is this certificate that must be included in the Trusted Root Certification Authorities certificate store.

3. Expand the Trusted Root Certification Authorities node and click on the Certificates node (figure 20). You will see the Root CA’s certificate in the right pane of the console.

In part 1 of this series on how to use EAP/TLS certificate-based authentication for gateway to gateway VPN routers, we examined all the steps required to make this configuration work and then went through the detailed step by step procedures required to obtain a machine certificate on the answering VPN gateway and making the Router (offline request) certificate template available on the enterprise CA’s Web enrollment site.