Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 400)

23-12

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring IPSec

Understanding Transform Sets

A transform set is a combination of security protocols and algorithms that define how the security

appliance protects data. You create multiple transform sets, and then specify one or more of them in a

crypto map entry.

During IPSec SA negotiations, the peers must identify a transform set that is the same at both peers. The

security appliance then applies the matching transform set to create an SA that protects data flows in the

access list for that crypto map entry.

If you change a transform set definition, the security appliance tears down the tunnel. See “Clearing

Security Associations” for further information.

Note If you clear or delete the last element from a transform set, the crypto map references to the destroyed

transform set are also removed.

Defining Crypto Maps

Crypto maps define IPSec policy. Crypto map entries pull together the various parts of an IPSec SA,

including the following:

• An access list that identifies the traffic that the IPSec connection permits and protects.

• Peer identification

• The local address for the IPSec traffic (See “Applying Crypto Maps to Interfaces” for more details.)

• One or more transform sets that specify the security to apply to the traffic.

Crypto map entries with the same crypto map name (but different map sequence numbers) are grouped

into a crypto map set. You apply crypto map sets to interfaces, and the security appliance evaluates all

IP traffic passing through the interface against that crypto map set.

The policy a crypto map entry defines applies during SA negotiations. If the local security appliance

initiates the negotiation, it uses the policy specified in the static crypto map entries to create the offer to

send to the specified peer. If the peer initiates the negotiation, the security appliance checks the policy

from the static crypto map entries, as well as any referenced dynamic crypto map entries to decide

whether to accept or reject the peer offer.

For two peers to succeed in establishing an SA, they must have at least one crypto map entry that is

compatible. To be compatible, crypto map entries must meet the following criteria:

• The crypto map entries must contain compatible crypto access lists (for example, mirror image

access lists). In the case where the responding peer is using dynamic crypto maps, the entries in the

security appliance crypto access list must be “permitted” by the peer crypto access list.

• The crypto map entries each identify the other peer (unless the responding peer is using dynamic

crypto maps).

• The crypto map entries have at least one transform set in common.

You can apply only one crypto map set to a single interface.

If you create more than one crypto map entry for a given interface, use the seq-num of each map entry

to rank the map entries: the lower the seq-num, the higher the priority. At the interface that has the crypto

map set, traffic is evaluated against higher priority map entries first.

1 2 ... 395 396 397 398 399 400 401 402 403 404 405 ... 603 604

Brak uwag

Cisco PIX 525 Dokumentacja Strona 400