Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 404)

100

101

23-16

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring IPSec

Assuming that the particular crypto map entry does not have lifetime values configured, when the

security appliance requests new security associations it specifies its global lifetime values in the request

to the peer; it uses this value as the lifetime of the new security associations. When the security appliance

receives a negotiation request from the peer, it uses the smaller of either the lifetime value the peer

proposes or the locally configured lifetime value as the lifetime of the new security associations.

A new security association is negotiated before the lifetime threshold of the existing security association

is reached to ensure that a new security association is ready for use when the old one expires. The new

security association is negotiated when approximate 5 to 15 per cent of the original SA lifetime remains.

Creating a Basic IPSec Configuration

The following steps cover basic IPSec configuration with static crypto maps.

Step 1 Create an access list to define the traffic to protect:

access-list

access-list-name

{deny | permit} ip

source source-netmask destination

destination-netmask

For example:

access-list 101 permit ip 10.0.0.0 255.255.255.0 10.1.1.0 255.255.255.0

In this example, the permit keyword causes all traffic that matches the specified conditions to be

protected by crypto.

Step 2 Configure a transform set that defines how to protect the traffic. You can configure multiple transform

sets, and then specify one or more of these transform sets in a crypto map entry (Step 3c).

crypto ipsec transform-set

transform-set-name

transform1

[

tcansform2

transform3

]

For example:

crypto ipsec transform-set myset1 esp-des esp-sha-hmac

crypto ipsec transform-set myset2 esp-3des esp-sha-hmac

crypto ipsec transform-set aes_set esp-md5-hmac esp-aes-256

In this example, “myset1” and “myset2” and “aes_set” are the names of the transform sets.

Step 3 Create a crypto map entry by performing the following steps:

In this example, “mymap” is the name of the crypto map set. The map set sequence number is 10,

which is used to rank multiple entries within one crypto map set. The lower the sequence number,

the higher the priority.

a. Assign an access list to a crypto map entry:

crypto map

map-name seq-num

match address

access-list-name

For example:

crypto map mymap 10 match address 101

In this example, the access list named 101 is assigned to crypto map “mymap.”

b. Specify the peer to which the IPSec protected traffic can be forwarded:

crypto map

map-name seq-num

set peer

ip-address

1 2 ... 399 400 401 402 403 404 405 406 407 408 409 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 404

Komentarze do niniejszej Instrukcji