Cisco PIX 525 Especificaciones descargar pdf (Pagina 432)

25-18

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Group Policies

To disable the UDP port, enter the no form of this command. This enables inheritance of a value for the

IPSec over UDP port from another group policy.

hostname(config-group-policy)# ipsec-udp-port

port

The following example shows how to set an IPSec UDP port to port 4025 for the group policy named

“FirstGroup”:

hostname(config)# group-policy FirstGroup attributes

hostname(config-group-policy)# ipsec-udp-port 4025

Step 18 Set the rules for tunneling traffic by specifying the split-tunneling policy.

hostname(config-group-policy)# split-tunnel-policy {tunnelall | tunnelspecified |

excludespecified}

hostname(config-group-policy)# no split-tunnel-policy

The default is to tunnel all traffic. To set a split tunneling policy, enter the split-tunnel-policy command

in group-policy configuration mode. To remove the split-tunnel-policy attribute from the running

configuration, enter the no form of this command. This enables inheritance of a value for split tunneling

from another group policy.

Split tunneling lets a remote-access IPSec client conditionally direct packets over an IPSec tunnel in

encrypted form or to a network interface in clear text form. With split tunneling enabled, packets not

bound for destinations on the other side of the IPSec tunnel do not have to be encrypted, sent across the

tunnel, decrypted, and then routed to a final destination. This command applies this split tunneling policy

to a specific network.

The excludespecified keyword defines a list of networks to which traffic goes in the clear. This feature

is useful for remote users who want to access devices on their local network, such as printers, while they

are connected to the corporate network through a tunnel. This option applies only to the Cisco VPN

client.

The tunnelall keyword specifies that no traffic goes in the clear or to any other destination than the

security appliance. This, in effect, disables split tunneling. Remote users reach internet networks through

the corporate network and do not have access to local networks. This is the default option.

The tunnelspecified keyword tunnels all traffic from or to the specified networks. This option enables

split tunneling. It lets you create a network list of addresses to tunnel. Data to all other addresses travels

in the clear and is routed by the remote user’s Internet service provider.

Note Split tunneling is primarily a traffic management feature, not a security feature. For optimum

security, we recommend that you do not enable split tunneling.

The following example shows how to set a split tunneling policy of tunneling only specified networks

for the group policy named “FirstGroup”:

hostname(config)# group-policy FirstGroup attributes

hostname(config-group-policy)# split-tunnel-policy tunnelspecified

Step 19 Create a network list for split tunneling using the split-tunnel-network-list command in group-policy

configuration mode.

hostname(config-group-policy)# split-tunnel-network-list {value

access-list_name

| none}

hostname(config-group-policy)# no split-tunnel-network-list value [

access-list_name

]

Split tunneling network lists distinguish networks that require traffic to travel across the tunnel from

those that do not require tunneling. The security appliance makes split tunneling decisions on the basis

of a network list, which is an ACL that consists of a list of addresses on the private network. Only

standard-type ACLs are allowed.

1 2 ... 427 428 429 430 431 432 433 434 435 436 437 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 432

Comentarios a estos manuales