Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 390)

100

101

23-2

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

IPSec Overview

IPSec provides the most complete architecture for VPN tunnels, and it is perceived as the most secure

protocol. IPSec provides authentication and encryption services to prevent unauthorized viewing or

modification of data within your network or as it travels over an unprotected network, such as the public

Internet. Our implementation of the IPSec standard uses the ESP security protocol to provide

authentication, encryption, and anti-replay services.

The security appliance implements IPSec in two types of configurations:

• LAN-to-LAN configurations are between two IPSec security gateways, such as security appliance

units or other protocol-compliant VPN devices. A LAN-to-LAN VPN connects networks in different

geographic locations.

• Remote access configurations provide secure remote access for VPN clients, such as mobile users.

A remote access VPN lets remote users securely access centralized network resources. The VPN

client complies with the IPSec protocol and is specifically designed to work with the security

appliance. However, the security appliance can establish IPSec connections with many

protocol-compliant clients.

In IPSec LAN-to-LAN connections, the VPN concentrator can function as initiator or responder. In

IPSec remote access connections, the VPN concentrator functions only as responder. Initiators propose

SAs; responders accept, reject, or make counter-proposals—all in accordance with configured SA

parameters. To establish a connection, both entities must agree on the SAs.

In IPSec terminology, a peer is a remote-access client or another secure gateway.

Configuring ISAKMP

This section describes the Internet Key Exchange protocol which is also called the Internet Security

Association and Key Management Protocol. The security appliance IKE commands use ISAKMP as a

keyword, which this guide echoes. ISAKMP works with IPSec to make VPNs more scalable. This

section includes the following topics:

• ISAKMP Overview, page 23-3

• Configuring ISAKMP Policies, page 23-4

• Enabling ISAKMP on the Outside Interface, page 23-5

• Disabling ISAKMP in Aggressive Mode, page 23-6

• Determining an ID Method for ISAKMP Peers, page 23-6

• Enabling IPSec over NAT-T, page 23-7

• Enabling IPSec over TCP, page 23-7

• Waiting for Active Sessions to Terminate Prior to Reboot, page 23-8

• Alerting Peers Before Disconnecting, page 23-8

1 2 ... 385 386 387 388 389 390 391 392 393 394 395 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 390

Kommentare zu diesen Handbüchern