Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 393)

100

101

23-5

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring ISAKMP

To enable and configure ISAKMP, complete the following steps, using the examples as a guide:

Note If you do not specify a value for a given policy parameter, the default value applies.

Step 1 Specify the encryption algorithm. The default is Triple DES. This example sets encryption to DES.

isakmp policy

priority

encryption [aes | aes-192 | aes-256 | des | 3des]

For example:

hostname(config)# isakmp policy 2 encryption des

Step 2 Specify the hash algorithm. The default is SHA-1. This example configures MD5.

isakmp policy

priority

hash [md5 | sha]

For example:

hostname(config)# isakmp policy 2 hash md5

Step 3 Specify the authentication method. The default is preshared keys.This example configures RSA

signatures.

isakmp policy

priority

authentication [pre-share | dsa-sig | rsa-sig]

For example:

hostname(config)# isakmp policy 2 authentication rsa-sig

Step 4 Specify the Diffie-Hellman group identifier. The default is Group 2. This example configures Group 5.

isakmp policy

priority

group [1 | 2 | 5 | 7]

For example:

hostname(config)# isakmp policy 2 group 5

Step 5 Specify the security association lifetime. This examples sets a lifetime of 4 hours (14400 seconds). The

default is 86400 seconds (24 hours).

isakmp policy

priority

lifetime

seconds

For example:

hostname(config)# isakmp policy 2 lifetime 14400

Enabling ISAKMP on the Outside Interface

You must enable ISAKMP on the interface that terminates the VPN tunnel. Typically this is the outside,

or public interface.

To enable ISAKMP, enter the following command:

isakmp enable

interface-name

For example:

hostname(config)# isakmp enable outside

1 2 ... 388 389 390 391 392 393 394 395 396 397 398 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 393

Komentarze do niniejszej Instrukcji