Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 265)

100

101

7-23

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 7 Site-to-Site VPN Configuration Examples

Using an Encrypted Tunnel to Obtain Certificates

PIX Firewall 2 Configuration

Follow these steps to configure PIX Firewall 2:

Step 1 Define a host name:

hostname SanJose

Step 2 Define the domain name:

domain-name example.com

Step 3 Configure an IKE policy:

isakmp enable outside

isakmp policy 8 auth pre-share

isakmp key cisco address 209.165.201.8 netmask 255.255.255.255

Step 4 Create a partial access list:

access-list 80 permit ip host 209.165.200.229 host 10.1.0.2

Step 5 Configure NAT 0:

nat (inside) 0 access-list 80

Step 6 Configure a transform set that defines how the traffic will be protected:

crypto ipsec transform-set strong esp-3des esp-sha-hmac

Step 7 Define a crypto map:

crypto map newyork 20 ipsec-isakmp

crypto map newyork 20 match address 80

crypto map newyork 20 set transform-set strong

crypto map newyork 20 set peer 209.165.201.8

Step 8 Apply the crypto map to the outside interface:

crypto map newyork interface outside

Step 9 Tell the PIX Firewall to implicitly permit IPSec traffic:

sysopt connection permit-ipsec

Step 10 Generate the PIX Firewall RSA key pair:

ca generate rsa key 512

This command is entered at the command line and does not get stored in the configuration.

Step 11 Define CA-related enrollment commands:

ca identity abcd 10.1.0.2:/certsrv/mscep/mscep.dll

ca configure abcd ra 1 20 crloptional

These commands are stored in the configuration.

Note The ca identity command shown is specific to the Microsoft CA. The ca identity you use

depends on the CA you are using.

1 2 ... 260 261 262 263 264 265 266 267 268 269 270 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 265

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525