Cisco PIX 525 Especificaciones descargar pdf (Pagina 238)

6-26

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Manual Configuration of SAs

Step 3 Create a crypto map entry by performing the following steps:

a. Create a crypto map entry in IPSec manual configuration mode:

crypto map map-name seq-num ipsec-manual

For example:

crypto map mymap 10 ipsec-manual

In this example, “mymap” is the name of the crypto map set. The map set’s sequence number is 10,

which is used to rank multiple entries within one crypto map set. The lower the sequence number,

the higher the priority.

b. Assign an access list to a crypto map entry:

crypto map map-name seq-num match address access-list-name

For example:

crypto map mymap 10 match address 101

In this example, access list 101 is assigned to crypto map “mymap.”

c. Specify the peer to which the IPSec protected traffic can be forwarded:

crypto map map-name seq-num set peer ip-address

For example:

crypto map mymap 10 set peer 192.168.1.100

The security association will be set up with the peer having an IP address of 192.168.1.100. Specify

multiple peers by repeating this command.

d. Specify which transform sets are allowed for this crypto map entry. List multiple transform sets in

order of priority (highest priority first). You can specify up to six transform sets.

crypto map map-name seq-num set transform-set transform-set-name1

[transform-set-name2, …transform-set-name6]

For example:

crypto map mymap 10 set transform-set myset1 myset2

In this example, when traffic matches access list 101, the security association can use either

“myset1” (first priority) or “myset2” (second priority) depending on which transform set matches

the peer’s transform set.

Step 4 If the specified transform set includes the AH protocol (authentication via MD5-HMAC or

SHA-HMAC), set the AH Security Parameter Index (SPI) and key to apply to inbound protected traffic.

If the specified transform set includes only the ESP protocol, skip to

Step 6.

crypto map map-name seq-num set session-key inbound ah spi hex-key-data

For example:

crypto map mymaptwo 30 set session-key inbound ah 300

123456789A123456789A123456789A123456789A

In this example, the IPSec session key for AH protocol is specified within crypto map “mymaptwo” to

be used with the inbound protected traffic.

1 2 ... 233 234 235 236 237 238 239 240 241 242 243 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 238

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525