Cisco PIX 525 Especificaciones descargar pdf (Pagina 161)

4-9

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 4 Using PIX Firewall in SOHO Networks

Using PIX Firewall as an Easy VPN Remote Device

Note After enabling SUA, your local PIX Firewall will not require static credentials because credentials are

entered manually each time a connection is made. However, if SUA is disabled for any reason at the Easy

VPN Server, you will need static credentials to make a VPN connection. For this reason, if you have

static credentials in your local configuration, do not remove them unless you have a good reason to do so.

The following CLI clears the stored policy, as well as the currently running SUA configuration.

clear vpnclient

After entering this command (or before connecting a PIX Firewall to an Easy VPN Server for the first

time) the PIX Firewall is in “SUA_Unspecified” state. In this state, SUA is enabled if static

authentication credentials are not included in the configuration of the local PIX Firewall. Otherwise, if

static authentication credentials are included, SUA is disabled.

As mentioned earlier, the connection behavior of the PIX Firewall used as an Easy VPN Remote device

varies depending on whether it is in client mode or network extension mode. It also varies depending on

whether the local configuration contains static credentials (configured using the command vpnclient

username user password pass), and depending on its SUA state. This behavior is summarized in

Table 4-1.

Ta b l e 4-1 PIX Firewall Behavior in Different SUA States

PIX Firewall State Client Mode Network Extension Mode

SUA_Unspecified and the local

configuration contains static credentials.

Traffic from or through the

PIX

Firewall initiates the

VPN tunnel.

The VPN tunnel is initiated

automatically.

SUA_Unspecified and the local

configuration does not contain static

credentials.

Manual connection is

required.

Manual connection is

required.

SUA_Disabled. Static credentials are

required.

Traffic from or through the

PIX

Firewall initiates the

VPN tunnel.

The VPN tunnel is initiated

automatically and is

maintained in an open state.

SUA_Enabled. Static credentials are not

required.

Manual connection is

required.

Manual connection is

required.

Using Individual User Authentication

Individual User Authentication (IUA) causes clients on the inside network of the Easy VPN Remote to

be individually authenticated based on the IP address of the inside client. IUA supports authentication

with both static and dynamic password mechanisms.

IUA is enabled by means of the downloaded VPN policy and it cannot be configured locally. For

information about enabling IUA on a PIX

Firewall used as an Easy VPN Server, refer to the

“Configuring Individual User Authentication” section on page 8-4.

When IUA is enabled, each user on the network protected by the Easy VPN Remote device is prompted

for a user name and password when trying to initiate a connection. A PIX

Firewall acting as an Easy

VPN Server downloads the contact information for the AAA server to the Easy VPN Remote device,

which sends each authentication request directly to the AAA server. A Cisco 3000 Series VPN

Concentrator used as an Easy VPN Server performs proxy authentication to the AAA server. The Easy

VPN Remote device sends each authentication request to the Cisco 3000 Series VPN Concentrator.

1 2 ... 156 157 158 159 160 161 162 163 164 165 166 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 161

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525