Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 225)

6-13

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Configuring IPSec

Validity Date:

start date: 23:48:00 UTC Feb 18 2003

end date: 23:58:00 UTC Feb 18 2004

--------------------------------------------------------------------------------

To establish a VPN tunnel with this server, enter the following command on the PIX Firewall that will

receive this certificate:

ca verifycertdn cn*myvpn, ou=myou, o=myorg, st=ca, c=US

This command causes the receiving PIX Firewall to accept certificates with any DN having the following

attributes:

• Common name (CN) contains the string myvpn

• Organizational unit (OU) equals myou

• Organization (O) equals myorg

• State (ST) equals CA

• Country (C) equals US

You could be more restrictive by identifying a specific common name, or less restrictive by omitting the

CN attribute altogether.

You can use an asterisk (*) to match an attribute containing the string following the asterisk. Use an

exclamation mark (!) to match an attribute that does not contain the characters following the exclamation

mark.

Configuring IPSec

This section provides background information about IPSec and describes the procedures required to

configure the PIX

Firewall when using IPSec to implement a VPN. It contains the following topics:

• IPSec Overview, page 6-14

• Transform Sets, page 6-15

• Crypto Maps, page 6-15

• Applying Crypto Maps to Interfaces, page 6-17

• Access Lists, page 6-17

• IPSec SA Lifetimes, page 6-19

• Basic IPSec Configuration, page 6-20

• Diffie-Hellman Group 5, page 6-22

• Using Dynamic Crypto Maps, page 6-23

• Site-to-Site Redundancy, page 6-25

IPSec Overview

IPSec tunnels are sets of security associations that are established between two remote IPSec peers. The

security associations define which protocols and algorithms should be applied to sensitive packets, and

also specify the keying material to be used by the two peers. IPSec SAs are used during the actual

transmission of user traffic. SAs are unidirectional and are established separately for different security

protocols (AH and/or ESP).

1 2 ... 220 221 222 223 224 225 226 227 228 229 230 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 225

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525