Cisco PIX 525 Especificaciones descargar pdf (Pagina 237)

6-25

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Manual Configuration of SAs

When you cannot use IKE to establish SAs between your PIX Firewall and a remote IPSec peer, you can

manually configure the SAs. This is only practical with a limited number of IPSec peers having known

IP addresses (or DNS host names), so this method of configuration is most practical for site-to-site

VPNs.

Manually configuring SAs is very similar to the basic configuration described in “Configuring IPSec.”

The following are the main differences:

• The crypto map is configured using the ipsec-manual keyword, as in the following example:

crypto map map-name seq-num ipsec-manual

• SA lifetimes and perfect forward secrecy (PFS) are not configurable

• You manually configure the session keys on both IPSec peers

When you manually configure SAs, you lose the benefits of enhanced security and scalability that IKE

can provide. Manually configure each pair of IPSec peers that communicate securely, and session keys

do not change unless you manually reconfigure the SAs.

Note Manual configuration of SAs is not supported on the PIX 501 because of the restriction in the number

of ISAKMP peers allowed on that platform.

To manually configure SAs, perform the following steps:

Step 1 Create an access list to define the traffic to protect:

access-list access-list-name {deny | permit} ip source source-netmask destination

destination-netmask

For example:

access-list 101 permit ip 10.0.0.0 255.255.255.0 10.1.1.0 255.255.255.0

In this example, the permit keyword causes all traffic that matches the specified conditions to be

protected by crypto.

Step 2 Configure a transform set that defines how the traffic will be protected. You can configure multiple

transform sets, and then specify one or more of these transform sets in a crypto map entry (Step 4d).

crypto ipsec transform-set transform-set-name transform1 [transform2, transform3]

For example:

crypto ipsec transform-set myset1 esp-des esp-sha-hmac

crypto ipsec transform-set myset2 ah-sha-hmac esp-3des esp-sha-hmac

In this example, “myset1” and “myset2” are the names of the transform sets. “myset1” has two

transforms defined, while “myset2” has three transforms defined.

1 2 ... 232 233 234 235 236 237 238 239 240 241 242 ... 465 466

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 237