Cisco PIX 525 Specifikace stáhnout pdf (Strana 217)

6-5

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Internet Key Exchange (IKE)

For further information about the two authentication methods, refer to the following sections:

• “Using IKE with Pre-Shared Keys”

• “Using Certification Authorities”

Step 5 Specify the Diffie-Hellman group identifier:

isakmp policy priority group 1 | 2 | 5

Note Support for Diffie-Hellman group 5 is introduced with PIX Firewall version 6.3

For example:

isakmp policy 20 group 2

Step 6 Specify the security association’s lifetime:

isakmp policy priority lifetime seconds

For example:

isakmp policy 20 lifetime 5000

The following example shows two policies with policy 20 as the highest priority, policy 30 as the next

priority, and the existing default policy as the lowest priority:

isakmp policy 20 encryption des

isakmp policy 20 hash md5

isakmp policy 20 authentication rsa-sig

isakmp policy 20 group 2

isakmp policy 20 lifetime 5000

isakmp policy 30 authentication pre-share

isakmp policy 30 lifetime 10000

In this example, the encryption des of policy 20 would not appear in the written configuration because

this is the default for the encryption algorithm parameter.

Step 7 (Optional) View all existing IKE policies:

show isakmp policy

The following is an example of the output after the policies 20 and 30 in the previous example were

configured:

Protection suite priority 20

encryption algorithm: DES - Data Encryption Standard (56 bit keys)

hash algorithm: Message Digest 5

authentication method: Rivest-Shamir-Adleman Signature

Diffie-Hellman group: #2 (1024 bit)

lifetime: 5000 seconds, no volume limit

Protection suite priority 30

encryption algorithm: DES - Data Encryption Standard (56 bit keys)

hash algorithm: Secure Hash Standard

authentication method: Pre-Shared Key

Diffie-Hellman group: #1 (768 bit)

lifetime: 10000 seconds, no volume limit

1 2 ... 212 213 214 215 216 217 218 219 220 221 222 ... 465 466

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 217

Komentáře k této Příručce

Související produkty a manuály pro Bezpečnostní systémy pro řízení přístupu Cisco PIX 525