Cisco 7100 Series Especificaciones descargar pdf (Pagina 42)

Step 3—Configuring Encryption

Cisco 7100 Series VPN Configuration Guide

3-12

IPSec is a framework of open standards, developed by the Internet Engineering Task Force

(IETF), that provides data conﬁdentiality, data integrity, and data authentication between

participating peers. IPSec provides these security services at the IP layer; it uses IKE to

handle negotiation of protocols and algorithms based on local policy, and to generate the

encryption and authentication keys to be used by IPSec. IPSec can be used to protect one

or more data ﬂows between a pair of hosts, between a pair of security gateways,or between

a security gateway and a host.

IKE is a hybrid security protocol that implements Oakley and SKEME key exchanges

inside the Internet Security Association & Key Management Protocol (ISAKMP)

framework. While IKE can be used with other protocols, its initial implementation is with

the IPSec protocol. IKE provides authentication of the IPSec peers, negotiates IPSec

security associations, and establishes IPSec keys.IPSec can be conﬁgured without IKE, but

IKE enhances IPSec by providing additional features, ﬂexibility, and ease of conﬁguration

for the IPSec standard.

CA interoperability is provided by the ISM in support of the IPSec standard. It permits

Cisco IOS devices and CAs to communicate so that your Cisco IOS device can obtain and

use digital certiﬁcates from the CA. Although IPSec can be implemented in your network

without the use of a CA, using a CA provides manageability and scalability for IPSec.

For the ISM in slot 5 of Cisco 7100 series routers to provide encryption services on the

GRE tunnel conﬁgured in the “Step 1—Conﬁguring the Tunnel” section on page 3-4, you

must complete the following steps:

1 Conﬁguring IKE Policies (Creating policies)

2 Conﬁguring IPSec (Creating access lists and transform sets)

3 Conﬁguring Crypto Maps (Creating crypto maps and assigning maps to interfaces)

Optionally, you can conﬁgure CA interoperability. This guide does not explain how to

conﬁgure CA interoperability on your Cisco 7100 series router. Refer to the “IP Security

and Encryption” part of the Security Conﬁguration Guide and the Security Command

Reference publications for detailed information on conﬁguring CA interoperabilty.

1 2 ... 37 38 39 40 41 42 43 44 45 46 47 ... 111 112

Sin comentarios

Cisco 7100 Series Especificaciones Pagina 42