Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 428)

25-14

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Group Policies

Note While there is no maximum limit to the number of simultaneous logins, allowing several could

compromise security and affect performance.

Step 7 Configure the user timeout period by entering the vpn-idle-timeout command in group-policy

configuration mode or in username configuration mode:

hostname(config-group-policy)# vpn-idle-timeout {minutes | none}

The minimum time is 1 minute, and the maximum time is 35791394 minutes. The default is 30 minutes.

If there is no communication activity on the connection in this period, the security appliance terminates

the connection.

A group policy can inherit this value from another group policy. To prevent inheriting a value, enter the

none keyword instead of specifying a number of minutes with this command. The none keyword also

permits an unlimited idle timeout period. It sets the idle timeout to a null value, thereby disallowing an

idle timeout.

The following example shows how to set a VPN idle timeout of 15 minutes for the group policy named

“FirstGroup”:

hostname(config)# group-policy FirstGroup attributes

hostname(config-group-policy)# vpn-idle-timeout 15

Step 8 Configure a maximum amount of time for VPN connections, using the vpn-session-timeout command

in group-policy configuration mode or in username configuration mode.

hostname(config-group-policy)# vpn-session-timeout {

minutes

| none}

The minimum time is 1 minute, and the maximum time is 35791394 minutes. There is no default value.

At the end of this period of time, the security appliance terminates the connection.

A group policy can inherit this value from another group policy. To prevent inheriting a value, enter the

none keyword instead of specifying a number of minutes with this command. Specifying the none

keyword permits an unlimited session timeout period and sets session timeout with a null value, which

disallows a session timeout.

The following example shows how to set a VPN session timeout of 180 minutes for the group policy

named “FirstGroup”:

hostname(config)# group-policy FirstGroup attributes

hostname(config-group-policy)# vpn-session-timeout 180

Step 9 Specify the name of the ACL to use for VPN connections, using the vpn-filter command in group policy

or username mode.

hostname(config-group-policy)# vpn-filter {value

ACL name

| none}

To remove the ACL, including a null value created by entering the vpn-filter none command, enter the

no form of this command. The no option allows inheritance of a value from another group policy.

A group policy can inherit this value from another group policy. To prevent inheriting a value, enter the

none keyword instead of specifying an ACL name. The none keyword indicates that there is no access

list and sets a null value, thereby disallowing an access list.

You configure ACLs to permit or deny various types of traffic for this group policy. You then enter the

vpn-filter command to apply those ACLs.

1 2 ... 423 424 425 426 427 428 429 430 431 432 433 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 428

Komentarze do niniejszej Instrukcji