Configuring a Hostname and Domain Name

Site 1 I g 10.0.1.0 R1 R6 10.0.6.0 I g Site 2

CA 172.26.26.51 VPNCA

CA 172.26.26.51 VPNCA

router(config)# hostname R1 R1(config)# ip domain-name cisco.com

© 2007 Cisco Systems, Inc. All rights reservecl.SNRS v2.0—4-19

You must configure the hostname and IP domain name of the router if this has not already been done. This process is required because the router assigns a fully qualified domain name (FQDN) to the keys and certificates used by IPsec, and the FQDN is based on the hostname and IP domain name that you assign to the router. For example, a certificate named "router20.example.com" is based on a router hostname of "router20" and a router IP domain name of "example.com."

Follow these steps to configure Domain Name System (DNS) parameters used with PKI:

Step 1 Specify or modify the hostname for the network server. The hostname is used in prompts and default configuration filenames. The setup command facility also prompts for a hostname at startup.

router(config)# hostname name

Syntax Description name

New hostname for the router

The hostname is used in prompts and default configuration filenames.

Do not expect case to be preserved. Uppercase and lowercase characters look the same to many Internet software applications. It may seem appropriate to capitalize a name the same way that you might in English, but conventions dictate that computer names appear all lowercase. For more information, refer to RFC 1178, Choosing a Name for Your Computer.

4-136 Securing Networks with Cisco Routers and Switches (SNRS) v2.0 © 2007 Cisco Systems, Inc.

The name must also follow the rules for Advanced Research Projects Agency Network (ARPANET) hostnames. Hostnames must start with a letter, end with a letter or digit, and have as interior characters only letters, digits, and hyphens. Hostnames must be 63 characters or fewer. A hostname of less than 10 characters is recommended. For more information, refer to RFC 1035, Domain Names—Implementation and Specification.

On most systems, a field of 30 characters is used for the hostname and the prompt in the command-line interface (CLI). Note that the length of your hostname may cause longer configuration mode prompts to be truncated.

Step 2 Define a default domain name that the Cisco IOS Software uses to complete unqualified hostnames (names without a dotted decimal domain name).

router(config)# ip domain-name name Syntax Description

name	Default domain name used to complete unqualified
	hostnames
	Do not include the initial period that separates an
	unqualified name from the domain name.

Any IP hostname that does not contain a domain name (that is, any name without a dot), will have the dot and cisco.com appended to it before being added to the host table.

© 2007 Cisco Systems, Inc. Secured Connectivity 4-137

Add a CA Server Entry to the Router Host Table

CA 172.26.26.51 VPNCA

R1(config)# ip host vpnca 172.26.26.51

© 2007 Cisco Systems, Inc. All rights reserved. SNRS V2.0—4-2C

You can map IP addresses to hostnames for DNS purposes. Use the ip host global configuration command to define a static hostname-to-address mapping in the host cache. To remove the name-to-address mapping, use the no form of this command.

Step 3 Define a static host to IP address mapping for the CA server.

router(config)# ip host [vrf vrf-name] {name I tmodem-telephone-number} [tcp-port-number] addressl [address2...address8]

Syntax Description

vrf vrf-name	(Optional) Defines a VPN routing and forwarding VRF table. The vrf-name argument specifies a name for the VRF table.
name	Name of the host. The first character can be either a letter or a number. If you use a number, the types of operations that you can perform are limited.
tmodem-telephone-number	Modem telephone number that is mapped to the IP host address for use in Cisco modem user interface mode. You must enter the letter "t" before the telephone number.
tcp-port-number	(Optional) TCP port number to connect to when using the defined hostname in conjunction with an EXEC connect or Telnet command. The default is Telnet (port 23).
address1	Associated IP host address.
address2...address8	(Optional) Additional associated IP addresses. You can bind up to eight addresses to a hostname.

The first character can be either a letter or a number. If you use a number, the types of operations that you can perform (such as ping) are limited.

4-138 Securing Networks with Cisco Routers and Switches (SNRS) v2.0

Generating an RSA Key Pair

This topic describes how to generate an RSA key pair to be used with PKI.

Generate an RSA Key Pair

VPNCA

VPNCA

R1(config)# crypto key generate rsa

© 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0^-21

RSA key pairs are used to sign and encrypt (IKE key management messages and are required before you can obtain a certificate for your router.

An RSA key pair consists of a public key and a private key. When setting up your PKI, you must include the public key in the certificate enrollment request. After the certificate has been granted, the public key will be included in the certificate so that peers can use it to encrypt data that is sent to the router. The private key is kept on the router and used both to decrypt the data sent by peers and to digitally sign transactions when negotiating with peers.

RSA key pairs contain a key modulus value. The modulus determines the size of the RSA key. The larger the modulus, the more secure the RSA key. However, keys with large modulus values take longer to generate, and encryption and decryption operations take longer with larger keys.

If you want a modulus value between 512 and 1024, enter an integer value that is a multiple of 64. If you want a value higher than 1024, enter 1536 or 2048. If you enter a value greater than 512, key generation may take a minute or longer.

Continue reading here: Usage RSA Keys Vs General Purpose RSA Keys

Was this article helpful?

0 -7