Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 392)

23-4

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring ISAKMP

You can have a maximum of 20ISAKMP policies, each with a different combination of values. For each

policy that you create, you assign a unique priority, with 1 representing a higher priority than 2.

When ISAKMP negotiations begin, the peer that initiates the negotiation sends all of its policies to the

remote peer, and the remote peer tries to find a match. The remote peer checks all of the peer's policies

against each of its configured policies in priority order (highest priority first) until it discovers a match.

A match exists when both policies from the two peers contain the same encryption, hash, authentication,

and Diffie-Hellman parameter values, and when the remote peer policy specifies a lifetime less than or

equal to the lifetime in the policy the initiator sent. If the lifetimes are not identical, the security

appliance uses the shorter lifetime. If no acceptable match exists, ISAKMP refuses negotiation and the

SA is not established.

There is an implicit trade-off between security and performance when you choose a specific value for

each parameter. The level of security the default values provide is adequate for the security requirements

of most organizations. If you are interoperating with a peer that supports only one of the values for a

parameter, your choice is limited to that value.

If you are upgrading from a PIX version 6.3 or older configuration, the security appliance includes a

default ISAKMP policy, which consists of the default configuration for each parameter. If you are

configuring a new security appliance, there is no default ISAKMP policy, although individual parameters

do have default values.

Configuring ISAKMP Policies

To configure ISAKMP policies, in global configuration mode, use the isakmp policy command with its

various arguments. The syntax for ISAKMP policy commands is as follows:

isakmp policy priority attribute_name [attribute_value | integer].

You must include the priority in each of the ISAKMP commands. The priority number uniquely

identifies the policy as well as setting its priority in ISAKMP negotiations.

isakmp policy group 1 Group 1 (768-bit) Specifies the Diffie-Hellman group identifier,

which the two IPSec peers use to derive a shared

secret without transmitting it to each other. The

default, Group 2 (1024-bit Diffie-Hellman)

requires less CPU time to execute but is less

secure than Group 5 or 7.

2 (default) Group 2 (1024-bit)

5 Group 5 (1536-bit)

7 Group 7 (Elliptical

curve field size is 163

bits.)

isakmp policy lifetime integer value

(86400 =

default)

120 to 2147483647

seconds

Specifies the SA lifetime. The default is 86,400

seconds or 24 hours. As a general rule, a shorter

lifetime (up to a point) provides more secure

ISAKMP negotiations. However, with shorter

lifetimes, the security appliance sets up future

IPSec security associations more quickly.

Table 23-1 ISAKMP Policy Keywords for CLI Commands (continued)

Command Keyword Meaning Description

1 2 ... 387 388 389 390 391 392 393 394 395 396 397 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 392

Kommentare zu diesen Handbüchern