Reference Manual for the ProSafe VPN Firewall FVS318v3
Advanced Virtual Private Networking 6-27
January 2005
b. Create a new VPN Auto Polic y calle d scenario2a with all the same properties as
scenario1a except that it uses the IKE policy called Scenario_2.
Now, the traffic from devices within the range of the LAN subnet addresses on FVS318v3 A
and Gateway B will be authenticated using the ce rtificates rather than via a shared key.
8. Set up Certificate Revocation List (CRL) checking.
a. Get a copy of the CRL from the CA and save it as a text file.
Note: The procedure for obtaining a CRL differs from a CA like Verisign and a CA such
as a Windows 2000 certificate server, which an organization operates for providing
certificates for its members. Follow the procedures of your CA.
b. From the main menu VPN section, click the CRL link.
c. Click Add to add a CRL.
d. Click Browse to locate the CRL file.
e. Click Upload.
Now expired or revoked certificates will not be allowed to use the VPN tunnels managed by
IKE policies which use this CA.
Note: You must update the CRLs regularly in order to maintain the validity of the
certificate-based VPN policies.