Cisco PIX 525 Specifikace stáhnout pdf (Strana 37)

1-5

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 1 Introduction to the Security Appliance

VPN Functional Overview

A VPN is a secure connection across a TCP/IP network (such as the Internet) that appears as a private

connection. This secure connection is called a tunnel. The security appliance uses tunneling protocols to

negotiate security parameters, create and manage tunnels, encapsulate packets, transmit or receive them

through the tunnel, and unencapsulate them. The security appliance functions as a bidirectional tunnel

endpoint: it can receive plain packets, encapsulate them, and send them to the other end of the tunnel

where they are unencapsulated and sent to their final destination. It can also receive encapsulated

packets, unencapsulate them, and send them to their final destination. The security appliance invokes

various standard protocols to accomplish these functions.

The security appliance performs the following functions:

• Establishes tunnels

• Negotiates tunnel parameters

• Authenticates users

• Assigns user addresses

• Encrypts and decrypts data

• Manages security keys

• Manages data transfer across the tunnel

• Manages data transfer inbound and outbound as a tunnel endpoint or router

The security appliance invokes various standard protocols to accomplish these functions.

Security Context Overview

You can partition a single security appliance into multiple virtual devices, known as security contexts.

Each context is an independent device, with its own security policy, interfaces, and administrators.

Multiple contexts are similar to having multiple standalone devices. Many features are supported in

multiple context mode, including routing tables, firewall features, IPS, and management. Some features

are not supported, including VPN and dynamic routing protocols.

In multiple context mode, the security appliance includes a configuration for each context that identifies

the security policy, interfaces, and almost all the options you can configure on a standalone device. The

system administrator adds and manages contexts by configuring them in the system configuration,

which, like a single mode configuration, is the startup configuration. The system configuration identifies

basic settings for the security appliance. The system configuration does not include any network

interfaces or network settings for itself; rather, when the system needs to access network resources (such

as downloading the contexts from the server), it uses one of the contexts that is designated as the admin

context.

The admin context is just like any other context, except that when a user logs into the admin context,

then that user has system administrator rights and can access the system and all other contexts.

Note You can run all your contexts in routed mode or transparent mode; you cannot run some contexts in one

mode and others in another.

Multiple context mode supports static routing only.

1 2 ... 32 33 34 35 36 37 38 39 40 41 42 ... 603 604

Žádné komentáře

Cisco PIX 525 Specifikace Strana 37