Cisco PIX 525 Especificaciones descargar pdf (Pagina 430)

25-16

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Group Policies

Enabling data compression might speed up data transmission rates for remote dial-in users connecting

with modems.

Caution Data compression increases the memory requirement and CPU usage for each user session and

consequently decreases the overall throughput of the security appliance. For this reason, we recommend

that you enable data compression only for remote users connecting with a modem. Design a group policy

specific to modem users, and enable compression only for them.

Step 13 Specify whether to require that users reauthenticate on IKE rekey by using the re-xauth command with

the enable keyword in group-policy configuration mode. To disable user reauthentication on IKE rekey,

enter the disable keyword.

hostname(config-group-policy)# re-xauth {enable | disable}

To remove the re-xauth attribute from the running configuration, enter the no form of this command.

This enables inheritance of a value for reauthentication on IKE rekey from another group policy.

hostname(config-group-policy)# no re-xauth

Reauthentication on IKE rekey is disabled by default.If you enable reauthentication on IKE rekey, the

security appliance prompts the user to enter a username and password during initial Phase 1 IKE

negotiation and also prompts for user authentication whenever an IKE rekey occurs. Reauthentication

provides additional security.

If the configured rekey interval is very short, users might find the repeated authorization requests

inconvenient. To avoid repeated authorization requests, disable reauthentication. To check the

configured rekey interval, in monitoring mode, enter the show crypto ipsec sa command to view the

security association lifetime in seconds and lifetime in kilobytes of data.

Note Reauthentication fails if there is no user at the other end of the connection.

Step 14 Specify whether to restrict remote users to access through the tunnel group only, using the group-lock

command in group-policy configuration mode.

hostname(config-group-policy)# group-lock {value

tunnel-grp-name

| none}

hostname(config-group-policy)# no group-lock

The tunnel-grp-name variable specifies the name of an existing tunnel group that the security appliance

requires for the user to connect. Group-lock restricts users by checking if the group configured in the

VPN client is the same as the tunnel group to which the user is assigned. If it is not, the security appliance

prevents the user from connecting. If you do not configure group-lock, the security appliance

authenticates users without regard to the assigned group. Group locking is disabled by default.

To remove the group-lock attribute from the running configuration, enter the no form of this command.

This option allows inheritance of a value from another group policy.

To disable group-lock, enter the group-lock command with the none keyword. The none keyword sets

group-lock to a null value, thereby allowing no group-lock restriction. It also prevents inheriting a

group-lock value from a default or specified group policy

Step 15 Specify whether to enable perfect forward secrecy by using the pfs command with the enable keyword

in group-policy configuration mode.

hostname(config-group-policy)# pfs {enable | disable}

In IPSec negotiations, PFS ensures that each new cryptographic key is unrelated to any previous key.

PFS is disabled by default.

1 2 ... 425 426 427 428 429 430 431 432 433 434 435 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 430

Comentarios a estos manuales