Cisco PIX 525 Especificaciones descargar pdf (Pagina 226)

6-14

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Configuring IPSec

You can establish IPSec SAs in two ways:

• Manual SAs with Pre-Shared Keys —The use of manual IPSec SAs requires a prior agreement

between administrators of the PIX

Firewall and the IPSec peer. There is no negotiation of SAs, so

the configuration information in both systems should be the same for traffic to be processed

successfully by IPSec.

• IKE-Established SAs—When IKE is used to establish IPSec SAs, the peers can negotiate the

settings they will use for the new security associations. This means that you can specify lists (such

as lists of acceptable transforms) within the crypto map entry.

The PIX Firewall can simultaneously support manual and IKE-established security associations.

Transform Sets

A transform set represents a certain combination of security protocols and algorithms. During the IPSec

security association negotiation, the peers agree to use a particular transform set for protecting a

particular data flow.

You can specify multiple transform sets, and then specify one or more of these transform sets in a crypto

map entry. The transform set defined in the crypto map entry will be used in the IPSec security

association negotiation to protect the data flows specified by that crypto map entry’s access list.

During IPSec security association negotiations with IKE, the peers search for a transform set that is the

same at both peers. When such a transform set is found, it is selected and will be applied to the protected

traffic as part of both peers’ IPSec security associations. With manually established security

associations, there is no negotiation with the peer, so both sides have to specify the same transform set.

If you change a transform set definition, the change will not be applied to existing security associations,

but will be used in subsequent negotiations to establish new security associations. If you want the new

settings to take effect sooner, clear all or part of the security association database by using the clear

[crypto] ipsec sa command. See “

Clearing SAs” for further information.

Crypto Maps

Crypto maps specify IPSec policy. Crypto map entries created for IPSec pull together the various parts

used to set up IPSec security associations, including the following:

• Which traffic should be protected by IPSec (per a crypto access list)

• Where IPSec-protected traffic should be sent (who the peer is)

• The local address to be used for the IPSec traffic (See “Applying Crypto Maps to Interfaces” for

more details.)

• What IPSec security should be applied to this traffic (selecting from a list of one or more transform

sets)

• Whether security associations are manually established or are established via IKE

• Other parameters that might be necessary to define an IPSec SA

Crypto map entries with the same crypto map name (but different map sequence numbers) are grouped

into a crypto map set. Later, you will apply these crypto map sets to interfaces; then, all IP traffic passing

through the interface is evaluated against the applied crypto map set. If a crypto map entry sees outbound

IP traffic that should be protected and the crypto map specifies the use of IKE, a security association is

negotiated with the peer according to the parameters included in the crypto map entry; otherwise, if the

1 2 ... 221 222 223 224 225 226 227 228 229 230 231 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 226

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525