Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 214)

6-2

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Internet Key Exchange (IKE)

IPSec can be configured to work in two different modes:

• Tunnel Mode—This is the normal way in which IPSec is implemented between two PIX Firewall

units (or other security gateways) that are connected over an untrusted network, such as the public

Internet.

• Transport Mode—This method of implementing IPSec is typically done with L2TP to allow

authentication of native Windows 2000 VPN clients. For information about configuring L2TP, refer

to “

Using PPTP for Remote Access,” in Chapter 8, “Managing VPN Remote Access.”

The main task of IPSec is to allow the exchange of private information over an insecure connection.

IPSec uses encryption to protect information from interception or eavesdropping. However, to use

encryption efficiently, both parties should share a secret that is used for both encryption and decryption

of the information.

IPSec operates in two phases to allow the confidential exchange of a shared secret:

• Phase 1, which handles the negotiation of security parameters required to establish a secure channel

between two IPSec peers. Phase 1 is generally implemented through the Internet Key Exchange

(IKE) protocol. If the remote IPSec peer cannot perform IKE, you can use manual configuration

with pre-shared keys to complete Phase 1.

• Phase 2, which uses the secure tunnel established in Phase 1 to exchange the security parameters

required to actually transmit user data.

The secure tunnels used in both phases of IPSec are based on security associations (SAs) used at each

IPSec end point. SAs describe the security parameters, such as the type of authentication and encryption

that both end points agree to use.

Internet Key Exchange (IKE)

This section describes the Internet Key Exchange (IKE) protocol and how it works with IPSec to make

VPNs more scalable. This section includes the following topics:

• IKE Overview, page 6-2

• Configuring IKE, page 6-4

• Disabling IKE, page 6-6

• Using IKE with Pre-Shared Keys, page 6-6

IKE Overview

IKE is a protocol used by IPSec for completion of Phase 1. IKE negotiates and assigns SAs for each

IPSec peer, which provide a secure channel for the negotiation of the IPSec SAs in Phase 2. IKE provides

the following benefits:

• Eliminates the need to manually specify all the IPSec security parameters at both peers

• Lets you specify a lifetime for the IKE SAs

• Allows encryption keys to change during IPSec sessions

• Allows IPSec to provide anti-replay services

• Enables CA support for a manageable, scalable IPSec implementation

• Allows dynamic authentication of peers

1 2 ... 209 210 211 212 213 214 215 216 217 218 219 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 214

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525