Cisco PIX 525 Especificaciones descargar pdf (Pagina 439)

25-25

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Group Policies

The following example shows how to set a client firewall policy that requires Cisco Intrusion Prevention

Security Agent for the group policy named “FirstGroup”:

hostname(config)# group-policy FirstGroup attributes

hostname(config-group-policy)# client-firewall req cisco-security-agent

Step 30 Configure rules that limit the remote access client types and versions that can connect via IPSec through

the security appliance by using the client-access-rule command in group-policy configuration mode. To

delete a rule, enter the no form of this command. This command is equivalent to the following command:

hostname(config-group-policy)# client-access-rule 1 deny type "Cisco VPN Client" version

4.0

To delete all rules, enter the no client-access-rule command without arguments. This deletes all

configured rules, including a null rule if you created one by issuing the client-access-rule command with

the none keyword.

By default, there are no access rules. When there are no client access rules, users inherit any rules that

exist in the default group policy.

To prevent users from inheriting client access rules, enter the client-access-rule command with the none

keyword. The result of this command is that all client types and versions can connect.

hostname(config-group-policy)# client-access rule

priority

{permit | deny} type

type

version {

version

| none}

hostname(config-group-policy)# no client-access rule [

priority

{permit | deny} type

type

version

]

Table 25-2 explains the meaning of the keywords and parameters in these commands.

sygate-security-agent Specifies Sygate Security Agent firewall type.

vendor-id Identifies the firewall vendor.

zonelabs-zonealarm Specifies Zone Labs Zone Alarm firewall type.

zonelabs-zonealarmorpro

policy

Specifies Zone Labs Zone Alarm or Pro firewall type.

zonelabs-zonealarmpro policy Specifies Zone Labs Zone Alarm Pro firewall type.

Table 25-1 client-firewall Command Parameters (continued)

Table 25-2 client-access rule Command Parameters

Parameter Description

deny Denies connections for devices of a particular type and/or version.

none Allows no client access rules. Sets client-access-rule to a null value, thereby

allowing no restriction. Prevents inheriting a value from a default or

specified group policy.

permit Permits connections for devices of a particular type and/or version.

priority Determines the priority of the rule. The rule with the lowest integer has the

highest priority. Therefore, the rule with the lowest integer that matches a

client type and/or version is the rule that applies. If a lower priority rule

contradicts, the security appliance ignores it.

1 2 ... 434 435 436 437 438 439 440 441 442 443 444 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 439

Comentarios a estos manuales