Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 433)

25-19

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Group Policies

The value access-list name parameter identifies an access list that enumerates the networks to tunnel or

not tunnel.

The none keyword indicates that there is no network list for split tunneling; the security appliance

tunnels all traffic. Specifying the none keyword sets a split tunneling network list with a null value,

thereby disallowing split tunneling. It also prevents inheriting a default split tunneling network list from

a default or specified group policy.

To delete a network list, enter the no form of this command. To delete all split tunneling network lists,

enter the no split-tunnel-network-list command without arguments. This command deletes all

configured network lists, including a null list if you created one by entering the none keyword.

When there are no split tunneling network lists, users inherit any network lists that exist in the default

or specified group policy. To prevent users from inheriting such network lists, enter the

split-tunnel-network-list none command.

The following example shows how to set a network list called “FirstList” for the group policy named

“FirstGroup”:

hostname(config)# group-policy FirstGroup attributes

hostname(config-group-policy)# split-tunnel-network-list FirstList

Step 20 Specify the default domain name. To set a default domain name for users of the group policy, enter the

default-domain command in group-policy configuration mode. To delete a domain name, enter the no

form of this command.

hostname(config-group-policy)# default-domain {value

domain-name

| none}

hostname(config-group-policy)# no default-domain [

domain-name

]

The security appliance passes the default domain name to the IPSec client to append to DNS queries that

omit the domain field. This domain name applies only to tunneled packets. When there are no default

domain names, users inherit the default domain name in the default group policy.

The value domain-name parameter identifies the default domain name for the group. To specify that

there is no default domain name, enter the none keyword. This command sets a default domain name

with a null value, which disallows a default domain name and prevents inheriting a default domain name

from a default or specified group policy.

To delete all default domain names, enter the no default-domain command without arguments. This

command deletes all configured default domain names, including a null list if you created one by

entering the default-domain command with the none keyword. The no form allows inheriting a domain

name.

The following example shows how to set a default domain name of “FirstDomain” for the group policy

named “FirstGroup”:

hostname(config)# group-policy FirstGroup attributes

hostname(config-group-policy)# default-domain value FirstDomain

Step 21 Enter a list of domains to be resolved through the split tunnel. Enter the split-dns command in

group-policy configuration mode. To delete a list, enter the no form of this command.

When there are no split tunneling domain lists, users inherit any that exist in the default group policy.

To prevent users from inheriting such split tunneling domain lists, enter the split-dns command with the

none keyword.

To delete all split tunneling domain lists, enter the no split-dns command without arguments. This

deletes all configured split tunneling domain lists, including a null list created by issuing the split-dns

command with the none keyword.

1 2 ... 428 429 430 431 432 433 434 435 436 437 438 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 433

Komentarze do niniejszej Instrukcji