Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 397)

100

101

23-9

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring Certificate Group Matching

The security appliance can notify qualified peers (in LAN-to-LAN configurations), VPN clients and

VPN 3002 hardware clients of sessions that are about to be disconnected. The peer or client receiving

the alert decodes the reason and displays it in the event log or in a pop-up panel. This feature is disabled

by default.

Qualified clients and peers include the following:

• security appliances with Alerts enabled.

• VPN clients running version 4.0 or later software (no configuration required).

• VPN 3002 hardware clients running version 4.0 or later software, and with Alerts enabled.

• VPN 3000 Series concentrators running version 4.0 or later software, with Alerts enabled.

To enable disconnect notification to IPSec peers, enter the isakmp disconnect-notify command.

For example:

hostname(config)# isakmp disconnect-notify

Configuring Certificate Group Matching

Tunnel groups define user connection terms and permissions. Certificate group matching lets you match

a user to a tunnel group using either the Subject DN or Issuer DN of the user certificate.

To match users to tunnel groups based on these fields of the certificate, you must first create rules that

define a matching criteria, and then associate each rule with the desired tunnel group.

To create a certificate map, use the crypto ca certificate map command. To define a tunnel group, use

the tunnel-group command.

You must also configure a certificate group matching policy that sets one of the following methods for

identifying the permission groups of certificate users:

• Match the group from the rules

• Match the group from the OU field

• Use a default group for all certificate users

You can use any or all of these methods.

Creating a Certificate Group Matching Rule and Policy

To configure the policy and rules by which certificate-based ISAKMP sessions map to tunnel groups,

and to associate the certificate map entries with tunnel groups, enter the tunnel-group-map command

in global configuration mode.

The syntax follows:

tunnel-group-map enable {rules | ou | ike-id | peer ip}

tunnel-group-map [rule-index] enable policy

1 2 ... 392 393 394 395 396 397 398 399 400 401 402 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 397

Kommentare zu diesen Handbüchern