Cisco PIX 525 Especificaciones descargar pdf (Pagina 228)

6-16

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Configuring IPSec

Binding a crypto map to an interface will also initialize the run-time data structures, such as the security

association database and the security policy database. If the crypto map is modified in any way,

reapplying the crypto map to the interface will resynchronize the various run-time data structures with

the crypto map configuration. In addition, any existing connections will be torn down and will be

reestablished after the new crypto map is triggered.

Access Lists

By default, IPSec and all packets that traverse the PIX Firewall are subjected to blocking as specified by

access lists. To enable IPSec packets to traverse the PIX

Firewall, ensure that you have statements in

access lists that permit the packets. Optionally, the sysopt connection permit-ipsec command can be

configured to enable IPSec packets to bypass access list blocking.

Note The sysopt connection permit-ipsec command enables packets that have been processed by IPSec to

bypass access list checks.

IPSec packets that are destined to an IPSec tunnel are selected by the crypto map access list bound to

the outgoing interface. IPSec packets that arrive from an IPSec tunnel are authenticated/deciphered by

IPSec, and are subjected to the proxy identity match of the tunnel.

Crypto access lists are used to define which IP traffic will be protected by crypto and which traffic will

not be protected by crypto. For example, access lists can be created to protect all IP traffic between

Subnet A and Subnet Y or between Host A and Host B. (These access lists are similar to access lists used

with the access-group command. With the access-group command, the access list determines which

traffic to forward or block at an interface.)

The access lists themselves are not specific to IPSec. It is the crypto map entry referencing the specific

access list that defines whether IPSec processing is applied to the traffic matching a permit in the access

list.

Crypto access lists associated with IPSec crypto map entries have four primary functions:

• Select outbound traffic to be protected by IPSec (permit = protect).

• Indicate the data flow to be protected by the new security associations (specified by a single permit

entry) when initiating negotiations for IPSec security associations.

• Process inbound traffic to filter out and discard traffic that should have been protected by IPSec.

• Determine whether or not to accept requests for IPSec security associations on behalf of the

requested data flows when processing IKE negotiation from the peer. (Negotiation is only done for

ipsec-isakmp crypto map entries.) For the peer’s request to be accepted during negotiation, the peer

should specify a data flow that is “permitted” by a crypto access list associated with an

ipsec-isakmp crypto map command entry.

If you want certain traffic to receive one combination of IPSec protection (for example, authentication

only) and other traffic to receive a different combination of IPSec protection (for example, both

authentication and encryption), you must create two different crypto access lists to define the two

different types of traffic. These different access lists are then used in different crypto map entries which

specify different IPSec policies.

Using the permit keyword causes all IP traffic that matches the specified conditions to be protected by

crypto, using the policy described by the corresponding crypto map entry. Using the deny keyword

prevents traffic from being protected by crypto IPSec in the context of that particular crypto map entry.

1 2 ... 223 224 225 226 227 228 229 230 231 232 233 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 228

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525