Cisco PIX 525 Especificaciones descargar pdf (Pagina 406)

23-18

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring IPSec

Using Dynamic Crypto Maps

Dynamic crypto maps can ease IPSec configuration and we recommend them for use in networks where

the peers are not always predetermined. You use dynamic crypto maps for VPN clients (such as mobile

users) and routers that obtain dynamically assigned IP addresses.

Note Use care when using the any keyword in permit command entries in dynamic crypto maps. If it is

possible for the traffic covered by such a permit command entry to include multicast or broadcast traffic,

the access list should include deny command entries for the appropriate address range. Access lists

should also include deny command entries for network and subnet broadcast traffic, and for any other

traffic that IPSec should not protect.

Dynamic crypto maps work only to negotiate SAs with remote peers that initiate the connection. The

security appliance cannot use dynamic crypto maps to initiate connections to a remote peer. With a

dynamic crypto map entry, if outbound traffic matches a permit statement in an access list and the

corresponding security association does not yet exist, the security appliance drops the traffic.

A dynamic crypto map entry is essentially a crypto map entry without all the parameters configured. It

acts as a policy template where the missing parameters are later dynamically configured (as the result of

an IPSec negotiation) to match the peer requirements. Dynamic crypto maps let peers exchange IPSec

traffic with the security appliance even if the security appliance does not have a crypto map entry

specifically configured that meets all the peer requirements.

Note A dynamic crypto map entry requires only the transform-set parameter.

A dynamic crypto map set is included by reference as part of a crypto map set. Any crypto map entries

that reference dynamic crypto map sets should be the lowest priority crypto map entries in the crypto

map set (that is, have the highest sequence numbers) so that the security appliance evaluates other crypto

map entries first. It examines the dynamic crypto map set only when the other (static) map entries do not

match.

Dynamic crypto map entries, like regular static crypto map entries, are grouped into sets. A set is a group

of dynamic crypto map entries all with the same dynamic-map-name but each with a different

dynamic-seq-num. If you configure a dynamic crypto map entry, the data flow identity the IPSec peer

proposes should fall within a permit statement for this crypto access list bound to this static crypto map.

Otherwise the security appliance accepts any data flow identity the peer proposes.

You can add one or more dynamic crypto map sets into a crypto map set via crypto map entries that

reference the dynamic crypto map sets. You should set the crypto map entries referencing dynamic maps

to be the lowest priority entries in a crypto map set (that is, use the highest sequence numbers).

Note Use care when using the any keyword in permit entries in dynamic crypto maps. If it is possible for the

traffic covered by such a permit entry to include multicast or broadcast traffic, the access list should

include deny entries for the appropriate address range. Access lists should also include deny entries for

network and subnet broadcast traffic, and for any other traffic that IPSec should not protect.

The procedure for using a crypto dynamic map entry is the same as the basic configuration described in

“Creating a Basic IPSec Configuration,” except that instead of creating a static crypto map entry, you

create a crypto dynamic map entry. You can also combine static and dynamic map entries within a single

crypto map set.

1 2 ... 401 402 403 404 405 406 407 408 409 410 411 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 406

Comentarios a estos manuales