Cisco WS-X4604-GWY - VoIP Gateway Especificaciones descargar pdf (Pagina 119)

7-5

Cisco Catalyst 4000 Access Gateway Module Installation and Configuration Note

OL-3008-01

Chapter 7 Configuring Encryption Services

Configuring the Encryption Service Adapter

Step 7

gateway(config-crypto map)# match

address [access_list_id | name]

Specifies an extended access list for a crypto map entry.

This value should match the access-list-number or name

argument of the extended access list.

Step 8

gateway(cfg-crypto-trans)# exit

Returns to global configuration mode.

Step 9

gateway(config)# access-list

access_list_number {permit | deny}

{type_code wild_mask | address mask}

Creates an access list.

access_list_number denotes an IP list number from 1

through 99.

permit or deny specifies permit or deny condition for this

list.

IP-address is the IP address to which the router compares

the address being tested.

wild-mask is the wildcard mask bits for the address in

32-bit, dotted decimal notation.

1. A security association (SA) describes how two or more entities will utilize security services to communicate securely. For example, an

IPSec SA defines the encryption algorithm (if used), the authentication algorithm, and the shared session key to be used during the IPSec

connection. Both IPSec and IKE require and use SAs to identify the parameters of their connections. IKE can negotiate and establish

its own SA. The IPSec SA is established either by IKE or by manual user configuration.

2. A transform set represents a specific combination of security protocols and algorithms. During the IPSec security association

negotiation, the peers search for a transform set that is the same on both peers. When such a transform set is found, it is selected and

applied to the protected traffic as part of both peers’ IPSec security associations.

3. With IPSec you define what traffic should be protected between two IPSec peers by configuring access lists and applying these access

lists to interfaces by way of crypto map sets. A crypto map set can contain multiple entries, each with a different access list. The crypto

map entries are searched in order, and the Catalyst 4224 attempts to match the packet to the access list specified in that entry.

4. Packet filtering helps control packet movement through the network. Such control can help limit network traffic and restrict network

use by certain users or devices. To permit or deny packets from crossing specified interfaces, we provide access lists. An access list is

a sequential collection of permit and deny conditions that apply to IP addresses.

Command Purpose (continued)

1 2 ... 114 115 116 117 118 119 120 121 122 123 124 ... 165 166

Sin comentarios

Cisco WS-X4604-GWY - VoIP Gateway Especificaciones Pagina 119