Cisco PIX 525 Specifikace stáhnout pdf (Strana 232)

6-20

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Configuring IPSec

Note PIX Firewall version 6.3 introduces support for AES, which provides for encryption keys of 128,

192, and 256 bits.

In this example, “myset1” and “myset2” are the names of the transform sets. “myset1” has two

transforms defined, while “myset2” has three transforms defined.

Step 3 Create a crypto map entry by performing the following steps:

a. Create a crypto map entry in IPSec ISAKMP mode:

crypto map map-name seq-num ipsec-isakmp

For example:

crypto map mymap 10 ipsec-isakmp

In this example, “mymap” is the name of the crypto map set. The map set’s sequence number is 10,

which is used to rank multiple entries within one crypto map set. The lower the sequence number,

the higher the priority.

b. Assign an access list to a crypto map entry:

crypto map map-name seq-num match address access-list-name

For example:

crypto map mymap 10 match address 101

In this example, access list 101 is assigned to crypto map “mymap.”

c. Specify the peer to which the IPSec protected traffic can be forwarded:

crypto map map-name seq-num set peer ip-address

For example:

crypto map mymap 10 set peer 192.168.1.100

The security association will be set up with the peer having an IP address of 192.168.1.100. Specify

multiple peers by repeating this command.

d. Specify which transform sets are allowed for this crypto map entry. List multiple transform sets in

order of priority (highest priority first). You can specify up to six transform sets.

crypto map map-name seq-num set transform-set transform-set-name1

[transform-set-name2, …transform-set-name6]

For example:

crypto map mymap 10 set transform-set myset1 myset2

In this example, when traffic matches access list 101, the security association can use either

“myset1” (first priority) or “myset2” (second priority) depending on which transform set matches

the peer’s transform set.

e. (Optional) Specify security association lifetime for the crypto map entry, if you want the security

associations for this entry to be negotiated using different IPSec security association lifetimes other

than the global lifetimes.

crypto map map-name seq-num set security-association lifetime {seconds seconds |

kilobytes kilobytes}

For example:

1 2 ... 227 228 229 230 231 232 233 234 235 236 237 ... 465 466

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 232

Komentáře k této Příručce

Související produkty a manuály pro Bezpečnostní systémy pro řízení přístupu Cisco PIX 525