Cisco PIX 525 Specifikace stáhnout pdf (Strana 396)

100

101

23-8

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring ISAKMP

IPSec over TCP works with remote access clients. You enable it globally, and it works on all ISAKMP

enabled interfaces. It is a client to security appliance feature only. It does not work for LAN-to-LAN

connections.

• The security appliance can simultaneously support standard IPSec, IPSec over TCP, NAT-Traversal,

and IPSec over UDP, depending on the client with which it is exchanging data.

• The VPN 3002 hardware client, which supports one tunnel at a time, can connect using standard

IPSec, IPSec over TCP, NAT-Traversal, or IPSec over UDP.

• When enabled, IPSec over TCP takes precedence over all other connection methods.

You enable IPSec over TCP on both the security appliance and the client to which it connects.

You can enable IPSec over TCP for up to 10 ports that you specify. If you enter a well-known port, for

example port 80 (HTTP) or port 443 (HTTPS), the system displays a warning that the protocol associated

with that port no longer works on the public interface. The consequence is that you can no longer use a

browser to manage the security appliance through the public interface. To solve this problem,

reconfigure the HTTP/HTTPS management to different ports.

The default port is 10000.

You must configure TCP port(s) on the client as well as on the security appliance. The client

configuration must include at least one of the ports you set for the security appliance.

To enable IPSec over TCP globally on the security appliance, enter the following command:

isakmp ipsec-over-tcp [port

port 1...port0

]

This example enables IPSec over TCP on port 45:

hostname(config)# isakmp ctcp port 45

Waiting for Active Sessions to Terminate Prior to Reboot

You can schedule a security appliance reboot to occur only when all active sessions have terminated

voluntarily. This feature is disabled by default.

To enable waiting for all active sessions to voluntarily terminate before the security appliance reboots,

enter the following command:

isakmp reload-wait

For example:

hostname(config)# isakmp reload-wait

Use the reload command to reboot the security appliance. If you set the reload-wait command, you can

use the reload quick command to override the reload-wait setting. The reload and reload-wait

commands are available in Privileged EXEC mode; neither includes the isakmp prefix.

Alerting Peers Before Disconnecting

Remote access or LAN-to-LAN sessions may be dropped for several reasons, such as: a security

appliance shutdown or reboot, session idle timeout, maximum connection time exceeded, or

administrator cut-off.

1 2 ... 391 392 393 394 395 396 397 398 399 400 401 ... 603 604

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 396

Komentáře k této Příručce