Cisco PIX 525 Especificaciones descargar pdf (Pagina 403)

23-15

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring IPSec

If you configure multiple statements for a given crypto access list that is used for IPSec, in general the

first permit statement that matches is the statement that determines the scope of the IPSec security

association. That is, the IPSec security association is set up to protect traffic that meets the criteria of

the matched statement only. Later, if traffic matches a different permit statement of the crypto access list,

a new, separate IPSec security association is negotiated to protect traffic matching the newly matched

access list statement.

The security appliance drops any unprotected inbound traffic that matches a permit entry in the crypto

access list for a crypto map entry flagged as IPSec because the security appliance expects this traffic to

be protected by IPSec.

Note If you clear or delete the last element from an access list, the crypto map references to the destroyed

access list are also removed.

If you modify an access list that is currently referenced by one or more crypto map entries, the run-time

security association database must be re initialized using the crypto map interface command. See the

crypto map command for more information.

We recommend that for every crypto access list specified for a static crypto map entry that you define at

the local peer, you define a “mirror image” crypto access list at the remote peer. This ensures that traffic

that has IPSec protection applied locally can be processed correctly at the remote peer. (The crypto map

entries themselves should also support common transforms and refer to the other system as a peer.)

Note Every static crypto map must define an access list and an IPSec peer. If either is missing, the crypto map

is incomplete and the security appliance drops any traffic that it has not already matched to an earlier,

complete crypto map. Use the show conf command to ensure that every crypto map is complete. To fix

an incomplete crypto map, remove the crypto map, add the missing entries, and reapply it.

When you create crypto access lists, using the any keyword could cause problems. We discourage the

use of the any keyword to specify source or destination addresses.

We strongly discourage the permit any any command statement, as this causes all outbound traffic to

be protected (and all protected traffic sent to the peer specified in the corresponding crypto map entry)

and requires protection for all inbound traffic. Then the security appliance silently drops all inbound

packets that lack IPSec protection.

Be sure that you define which packets to protect. If you use the any keyword in a permit command

statement, preface that statement with a series of deny command statements to filter out any traffic (that

would otherwise fall within that permit command statement) that you do not want to be protected.

Changing IPSec SA Lifetimes

You can change the global lifetime values that the security appliance uses when negotiating new IPSec

security associations. You can override these global lifetime values for a particular crypto map entry.

There are two lifetimes: a “timed” lifetime and a “traffic-volume” lifetime. A security association

expires after the respective lifetime is reached and negotiations begin for a new one. The default lifetimes

are 28,800 seconds (eight hours) and 4,608,000 kilobytes (10 megabytes per second for one hour).

If you change a global lifetime, the security appliance drops the tunnel. It uses the new value in the

negotiation of subsequently established security associations.

IPSec security associations use a shared secret key. The key is an integral part of the security association,

and they time out together.

1 2 ... 398 399 400 401 402 403 404 405 406 407 408 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 403

Comentarios a estos manuales