Cisco PIX 525 Especificaciones descargar pdf (Pagina 395)

23-7

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring ISAKMP

Enabling IPSec over NAT-T

NAT-T lets IPSec peers establish a connection through a NAT device. It does this by encapsulating IPSec

traffic in UDP datagrams, using port 4500, thereby providing NAT devices with port information. NAT-T

auto-detects any NAT devices, and only encapsulates IPSec traffic when necessary. This feature is

disabled by default.

• The security appliance can simultaneously support standard IPSec, IPSec over TCP, NAT-T, and

IPSec over UDP, depending on the client with which it is exchanging data.

• When both NAT-T and IPSec over UDP are enabled, NAT-T takes precedence.

• When enabled, IPSec over TCP takes precedence over all other connection methods.

• When you enable NAT-T, the security appliance automatically opens port 4500 on all IPSec enabled

interfaces.

The security appliance implementation of NAT-T supports IPSec peers behind a single NAT/PAT device

as follows:

• One LAN-to-LAN connection.

• Either a LAN-to-LAN connection or multiple remote access clients, but not a mixture of both.

This restriction applies when you the IP address of the NAT device is the name of the tunnel group. This

is because all peers behind that NAT device are likely to be associated with that same tunnel group. This

may result in failed negotiations when connecting to multiple LAN-to-LAN peers behind the NAT

device, or VPN clients being associated to a NAT device when there a mixture of remote access and

LAN-to-LAN peers.

Using NAT-T

To use NAT-T you must perform three tasks:

1. Enable IPSec over NAT-T globally on the security appliance.

2. Select the “before-fragmentation” option for the IPSec fragmentation policy. This option lets traffic

travel across NAT devices that do not support IP fragmentation. It does not impede the operation of

NAT devices that do support IP fragmentation.

3. Set a keepalive value, which can be from 10 to 3600 seconds. The default is 20 seconds.

To enable NAT-T globally on the security appliance, enter the following command:

isakmp nat-traversal

natkeepalive

This example sets enables NAT-T and sets the keepalive to one hour.

hostname(config)# isakmp nat-traversal 3600

Enabling IPSec over TCP

IPSec over TCP enables a VPN client to operate in an environment in which standard ESP or ISAKMP

cannot function, or can function only with modification to existing firewall rules. IPSec over TCP

encapsulates both the ISAKMP and IPSec protocols within a TCP packet, and enables secure tunneling

through both NAT and PAT devices and firewalls. This feature is disabled by default.

Note This feature does not work with proxy-based firewalls.

1 2 ... 390 391 392 393 394 395 396 397 398 399 400 ... 603 604

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 395