Cisco PIX 525 Especificaciones descargar pdf (Pagina 236)

6-24

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Using Dynamic Crypto Maps

Step 4 Specify that IPSec should ask for PFS when requesting new security associations for this dynamic crypto

map entry, or should demand PFS in requests received from the peer:

crypto dynamic-map dynamic-map-name dynamic-seq-num set pfs [group1 | group2]

For example:

crypto dynamic-map dyn1 10 set pfs group1

Step 5 Add the dynamic crypto map set into a static crypto map set.

Be sure to set the crypto map entries referencing dynamic maps to be the lowest priority entries (highest

sequence numbers) in a crypto map set.

crypto map map-name seq-num ipsec-isakmp dynamic dynamic-map-name

For example:

crypto map mymap 200 ipsec-isakmp dynamic dyn1

Site-to-Site Redundancy

You can define multiple peers by using crypto maps to allow for redundancy. This configuration is also

most useful for site-to-site VPNs. If one peer fails, there will still be a protected path. The peer that

packets are actually sent to is determined by the last peer that the PIX

Firewall heard from (received

either traffic or a negotiation request from) for a given data flow. If the attempt fails with the first peer,

IKE tries the next peer on the crypto map list.

Using NAT Traversal

Network Address Translation (NAT) and Port Address Translation (PAT) are implemented in many

networks where IPSec is also used, but the a number of incompatibilities that prevent IPSec packets from

successfully traversing a NAT device.

PIX Firewall Version 6.3 provides a feature called “Nat Traversal,” as described by Version 2 and

Version 3 of the draft IETF standard, UDP Encapsulation of IPsec Packets,” which is available at the

following URL:

http://www.ietf.org/html.charters/ipsec-charter.html

NAT Traversal allows ESP packets to pass through one or more NAT devices. This feature is disabled by

default.

Note NAT Traversal is supported for both dynamic and static crypto maps.

To enable NAT traversal, enter the following command:

isakmp nat-traversal [natkeepalive]

Valid values for natkeepalive are 10 to 3600 seconds; the default is 20 seconds.

1 2 ... 231 232 233 234 235 236 237 238 239 240 241 ... 465 466

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 236