Cisco 7100 Series Spezifikationen PDF herunterladen (Seite 26)

Considerations

Cisco 7100 Series VPN Configuration Guide

2-4

— Be careful not to violate access control lists. You can conﬁgure a tunnel with a

source and destination that are not restricted by ﬁrewall routers.

— Routing protocols that make their decisions based solely on hop count will often

prefer a tunnel over a multipoint real link. A tunnel might appear to be a one-hop,

point-to-point link and have the lowest-cost path, but may actually cost more.

• IPSec—Observe the following when conﬁguring IPSec:

— IPSec works with the following serial encapsulations: High-Level Data Link

Control (HDLC), Point-to-Point Protocol (PPP), and Frame Relay. IPSec also

works with the GRE and IPinIP Layer 3, L2F, and L2TP tunneling protocols;

however, multipoint tunnels are not supported. Other Layer 3 tunneling protocols

(data-link switching [DLSW], source-route bridging [SRB], and so forth) are

currently not supported for use with IPSec.

— IPSec and Internet Key Exchange (IKE) must be conﬁgured on the router and a

crypto map assigned to all interfaces that require encryption services from the

Integrated Service Module (ISM) in slot 5 of Cisco 7100 series routers.

— IPSec can be applied to unicast IP datagrams only. Because the IPSec Working

Group has not yet addressed the issue of group key distribution, IPSec does not

currently work with multicasts or broadcast IP datagrams.

— If you use Network Address Translation (NAT), you should conﬁgure static NAT

redundant so that IPSec works properly. In general, NAT should occur before the

router performs IPSec encapsulation; in other words, IPSec should be working with

global addresses.

• Firewall—Observe the following when conﬁguring Cisco IOS Firewall features (when

conﬁguring your Cisco 7100 series router as a ﬁrewall):

— When setting passwords for privileged access to the ﬁrewall, use the enable secret

command rather than the enable password command, which does not have as

strong an encryption algorithm.

— Conﬁgure a password on the console port. In authentication, authorization, and

accounting (AAA) environments, use the same authentication for the console as for

elsewhere. In a non-AAA environment, at a minimum, conﬁgure the login and

password password commands.

1 2 ... 21 22 23 24 25 26 27 28 29 30 31 ... 111 112

Keine Kommentare

Cisco 7100 Series Spezifikationen Seite 26