Cisco PIX 525 Especificaciones descargar pdf (Pagina 416)

100

101

25-2

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Overview of Tunnel Groups, Group Policies, and Users

Note The security appliance also includes the concept of object groups, which are a superset of network lists.

Object groups let you define VPN access to ports as well as networks. Object groups relate to ACLs

rather than to group policies and tunnel groups. For more information about using object groups, see

Chapter 13, “Identifying Traffic with Access Lists.”

Tunnel Groups

A tunnel group consists of a set of records that contain tunnel connection policies. Tunnel groups contain

a small number of attributes that pertain to creating the tunnel itself. Tunnel groups include a pointer to

a group policy that defines user-oriented attributes.

The security appliance provides two default tunnel groups, one for LAN-to-LAN connections, and one

for remote access connections. You can modify these default tunnel groups, but you cannot delete them.

You can also create one or more tunnel groups specific to your environment. Tunnel groups are local to

the security appliance and are not configurable on external servers.

Tunnel groups specify the following attributes:

• General parameters

• IPSec connection parameters

General Tunnel Group Parameters

The general parameters include the following:

• Tunnel group name—Both remote access and LAN-to-LAN clients select a tunnel group by its

name, as follows:

–

For IPSec clients that use preshared keys to authenticate, the tunnel group name is the same as

the group name that the IPSec client passes to the security appliance.

–

IPSec clients that use certificates to authenticate pass this name as part of the certificate, and

the security appliance extracts the name from the certificate.

Tunnel group records contain tunnel connection policy information. These records identify the

servers to which the tunnel user is authenticated, as well as the accounting servers to which

connection information is sent. They also identify a default group policy for the connection, and they

contain protocol-specific connection parameters.

• Connection type—Connection types include remote access IPSec, and LAN-to-LAN IPSec. A

tunnel group can have only one connection type.

• Authentication, Authorization, and Accounting servers—These parameters identify the server

groups or lists that the security appliance uses for the following purposes:

–

Authenticating users

–

Obtaining information about services users are authorized to access

–

Storing accounting records

A server group can consist of one or more servers.

1 2 ... 411 412 413 414 415 416 417 418 419 420 421 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 416

Comentarios a estos manuales