Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 407)

100

101

23-19

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring IPSec

Create a crypto dynamic map entry by performing the following steps:

Step 1 (Optional) Assign an access list to a dynamic crypto map entry:

crypto dynamic-map

dynamic-map-name dynamic-seq-num

match address

access-list-name

This determines which traffic should be protected and not protected.

For example:

crypto dynamic-map dyn1 10 match address 101

In this example, access list 101 is assigned to dynamic crypto map “dyn1.” The map’s sequence number

is 10.

Step 2 Specify which transform sets are allowed for this dynamic crypto map entry. List multiple transform sets

in order of priority (highest priority first).

crypto dynamic-map

dynamic-map-name dynamic-seq-num

set transform-set

transform-set-name1

[

transform-set-name2

, …

transform-set-name9

]

For example:

crypto dynamic-map dyn 10 set transform-set myset1 myset2

In this example, when traffic matches access list 101, the security association can use either “myset1”

(first priority) or “myset2” (second priority) depending on which transform set matches the peer’s

transform sets.

Step 3 (Optional) Specify security association lifetime for the crypto dynamic map entry, if you want the

security associations for this entry to be negotiated using different IPSec security association lifetimes

other than the global lifetimes:

crypto dynamic-map

dynamic-map-name

dynamic-seq-num

set security-association lifetime

{seconds

seconds

| kilobytes

kilobytes

}

For example:

crypto dynamic-map dyn1 10 set security-association lifetime seconds 2700

This example shortens the timed lifetime for dynamic crypto map “dyn1 10” to 2700 seconds

(45 minutes). The time volume lifetime is not changed.

Step 4 (Optional) Specify that IPSec should ask for PFS when requesting new security associations for this

dynamic crypto map entry, or should demand PFS in requests received from the peer:

crypto dynamic-map

dynamic-map-name dynamic-seq-num

set pfs [group1 | group2 | group5 |

group7]

For example:

crypto dynamic-map dyn1 10 set pfs group5

Step 5 Add the dynamic crypto map set into a static crypto map set.

Be sure to set the crypto map entries referencing dynamic maps to be the lowest priority entries (highest

sequence numbers) in a crypto map set.

crypto map

map-name seq-num

ipsec-isakmp dynamic

dynamic-map-name

For example:

crypto map mymap 200 ipsec-isakmp dynamic dyn1

1 2 ... 402 403 404 405 406 407 408 409 410 411 412 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 407

Kommentare zu diesen Handbüchern