Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 160)

4-8

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 4 Using PIX Firewall in SOHO Networks

Using PIX Firewall as an Easy VPN Remote Device

Secure Unit Authentication (SUA) is configured as part of the VPN policy on the Easy VPN Server and

cannot be configured directly on the Easy VPN Remote device. After connecting to the Easy VPN

Server, the Easy VPN Remote device downloads the VPN policy, which then enables or disables SUA.

When SUA is disabled and the PIX Firewall is in network extension mode, a connection is automatically ini-

tiated. When SUA is disabled with client mode, the connection is automatically initiated whenever any traf-

fic is sent through the PIX Firewall to a network protected by the Easy VPN Server.

When SUA is enabled, static credentials included in the local configuration of the Easy VPN Remote device

are ignored. A connection request is initiated as soon as an HTTP request is sent from the remote network

to the network protected by the Easy VPN Server. All other traffic to the network protected by the Easy

VPN Server is dropped until a VPN tunnel is established. You can also initiate a connection request from

the CLI of the Easy VPN Remote device.

Establishing a Connection with SUA Enabled

After SUA is enabled and before a VPN tunnel is established, any HTTP request to the network protected

by the Easy VPN Server is redirected to the URL as follows:

https://inside-ipaddr/vpnclient/connstatus.html

Where inside-ipaddr is replaced by the IP address of the inside interface of the PIX Firewall used as the

Easy VPN Remote device. You can activate the connection by manually entering this URL in the Address

or Location box of a browser, and you can use this URL to check the status of the VPN tunnel.

This URL provides a page containing a Connect link that displays an authentication page. If

authentication is successful, the VPN tunnel is established. After the VPN tunnel is established, other

users on the network protected by the Easy VPN Remote device can access the network protected by the

Easy VPN Server without further authentication. If you want to control access by individual users, you

can implement Individual User Authentication, as described in the

“Using Individual User

Authentication” section on page 4-9.

You can manually initiate a connection from the CLI of the PIX Firewall used as an Easy VPN Remote

device, by entering the following command:

vpnclient connect

To close a connection using the CLI, enter the following command:

vpnclient disconnect

This causes the Easy VPN Remote device to disconnect from the Easy VPN Server and to tear down the

IKE tunnel. You can use the vpnclient connect and vpnclient disconnect commands to force an update

of the downloaded policy by disconnecting and reconnecting to the Easy VPN Server.

Managing Connection Behavior with SUA

After the VPN policy is downloaded, the PIX Firewall used as an Easy VPN Remote device stores the

downloaded policy, including the status of SUA, in a private area of the FLASH memory. This lets the

Easy VPN Remote device determine its connection behavior for the next connection attempt. After

downloading a VPN policy that changes its SUA status, the PIX Firewall automatically disconnects from

the Easy VPN Server. This allows the Easy VPN Remote device to immediately implement the change

in its SUA status.

1 2 ... 155 156 157 158 159 160 161 162 163 164 165 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 160

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525