Cisco PIX 525 Specifikace stáhnout pdf (Strana 227)

6-15

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Configuring IPSec

crypto map entry specifies the use of manual security associations, a security association should have

already been established via configuration. (If a dynamic crypto map entry sees outbound traffic that

should be protected and no security association exists, the packet is dropped.)

The policy described in the crypto map entries is used during the negotiation of security associations. If

the local PIX

Firewall initiates the negotiation, it will use the policy specified in the static crypto map

entries to create the offer to be sent to the specified peer. If the peer initiates the negotiation, the

PIX

Firewall will check the policy from the static crypto map entries, as well as any referenced dynamic

crypto map entries to decide whether to accept or reject the peer’s request (offer).

For IPSec to succeed between two peers, both peers’ crypto map entries have to contain compatible

configuration statements.

When two peers try to establish a security association, they should each have at least one crypto map

entry that is compatible with one of the other peer’s crypto map entries. For two crypto map entries to

be compatible, they should, at a minimum, meet the following criteria:

• The crypto map entries contain compatible crypto access lists (for example, mirror image access

lists). In the case where the responding peer is using dynamic crypto maps, the entries in the

PIX

Firewall crypto access list must be “permitted” by the peer’s crypto access list.

• The crypto map entries each identify the other peer (unless the responding peer is using dynamic

crypto maps).

• The crypto map entries have at least one transform set in common.

You can apply only one crypto map set to a single interface. The crypto map set can include a

combination of IPSec/IKE and IPSec/manual entries.

If you create more than one crypto map entry for a given interface, use the seq-num of each map entry

to rank the map entries: the lower the seq-num, the higher the priority. At the interface that has the crypto

map set, traffic is evaluated against higher priority map entries first.

Create multiple crypto map entries for a given PIX Firewall interface, if any of the following conditions

exist:

• If different data flows are to be handled by separate peers.

• If you want to apply different IPSec security to different types of traffic (to the same or separate

peers); for example, if you want traffic between one set of subnets to be authenticated, and traffic

between another set of subnets to be both authenticated and encrypted. In this case, the different

types of traffic should have been defined in two separate access lists, and you create a separate

crypto map entry for each crypto access list.

• If you are configuring manual SAs to establish a particular set of IPSec security associations, and

want to specify multiple access list entries, create separate access lists (one per permit entry) and

specify a separate crypto map entry for each access list.

Applying Crypto Maps to Interfaces

You must apply a crypto map set to each interface through which IPSec traffic will flow. The

PIX

Firewall supports IPSec on all of its interfaces. Applying the crypto map set to an interface instructs

the PIX

Firewall to evaluate all the interface’s traffic against the crypto map set and to use the specified

policy during connection or security association negotiation on behalf of traffic to be protected by crypto

IPSec.

1 2 ... 222 223 224 225 226 227 228 229 230 231 232 ... 465 466

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 227

Komentáře k této Příručce

Související produkty a manuály pro Bezpečnostní systémy pro řízení přístupu Cisco PIX 525