Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 231)

6-19

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Configuring IPSec

IPSec security associations use one or more shared secret keys. These keys and their security

associations time out together.

Assuming that the particular crypto map entry does not have lifetime values configured, when the

PIX

Firewall requests new security associations it will specify its global lifetime values in the request to

the peer; it will use this value as the lifetime of the new security associations. When the PIX

Firewall

receives a negotiation request from the peer, it will use the smaller of either the lifetime value proposed

by the peer or the locally configured lifetime value as the lifetime of the new security associations.

The security association and the corresponding keys expire after a configurable interval of time or after

forwarding a configurable volume of traffic.

A new security association is negotiated before the lifetime threshold of the existing security association

is reached to ensure that a new security association is ready for use when the old one expires. The new

security association is negotiated either 30 seconds before the seconds lifetime expires or when the

volume of traffic through the tunnel reaches 256 kilobytes less than the kilobytes lifetime (whichever

occurs first).

If no traffic has passed through the tunnel during the entire life of the security association, a new security

association is not negotiated when the lifetime expires. Instead, a new security association will be

negotiated only when IPSec sees another packet that should be protected.

Basic IPSec Configuration

The following steps cover basic IPSec configuration where the IPSec security associations are

established with IKE and static crypto maps are used. For information about configuring IPSec for

specific implementations, see the following chapters:

• Chapter 7, “Site-to-Site VPN Configuration Examples.”

• Chapter 8, “Managing VPN Remote Access.”

In general, to configure the PIX Firewall for using IPSec, perform the following steps:

Step 1 Create an access list to define the traffic to protect:

access-list access-list-name {deny | permit} ip source source-netmask destination

destination-netmask

For example:

access-list 101 permit ip 10.0.0.0 255.255.255.0 10.1.1.0 255.255.255.0

In this example, the permit keyword causes all traffic that matches the specified conditions to be

protected by crypto.

Step 2 Configure a transform set that defines how the traffic will be protected. You can configure multiple

transform sets, and then specify one or more of these transform sets in a crypto map entry (Step 3d).

crypto ipsec transform-set transform-set-name transform1 [transform2, transform3]

For example:

crypto ipsec transform-set myset1 esp-des esp-sha-hmac

crypto ipsec transform-set myset2 ah-sha-hmac esp-3des esp-sha-hmac

crypto ipsec transform-set aes_set ah-md5-hmac esp-aes-256

1 2 ... 226 227 228 229 230 231 232 233 234 235 236 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 231

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525