Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 417)

25-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Overview of Tunnel Groups, Group Policies, and Users

• Default group policy for the connection—A group policy is a set of user-oriented attributes. The

default group policy is the group policy whose attributes the security appliance uses as defaults

when authenticating or authorizing a tunnel user.

• Client address assignment method—This method includes values for one or more DHCP servers or

address pools that the security appliance assigns to clients.

IPSec Connection Parameters

IPSec parameters include the following:

• A client authentication method: preshared keys or certificates.

• ISAKMP keepalive settings. This feature lets the security appliance monitor the continued presence

of a remote peer and report its own presence to that peer. If the peer becomes unresponsive, the

security appliance removes the connection. Enabling IKE keepalives prevents hung connections

when the IKE peer loses connectivity.

There are various forms of IKE keepalives. For this feature to work, both the security appliance and

its remote peer must support a common form. This feature works with the following peers:

–

Cisco VPN client (Release 3.0 and above)

–

Cisco VPN 3000 Client (Release 2.x)

–

Cisco VPN 3002 Hardware Client

–

Cisco VPN 3000 Series Concentrators

–

Cisco IOS

software

–

Cisco Secure PIX Firewall

Non-Cisco VPN clients do not support IKE keepalives.

If you are configuring a group of mixed peers, and some of those peers support IKE keepalives and

others do not, enable IKE keepalives for the entire group. The feature does not affect the peers that

do not support it.

If you disable IKE keepalives, connections with unresponsive peers remain active until they time

out, so we recommend that you keep your idle timeout short. To change your idle timeout, see

“Configuring Group Policies” section on page 25-12.

Note To reduce connectivity costs, disable IKE keepalives if this group includes any clients

connecting via ISDN lines. ISDN connections normally disconnect if idle, but the IKE

keepalives mechanism prevents connections from idling and therefore from disconnecting.

If you do disable IKE keepalives, the client disconnects only when either its IKE or IPSec keys

expire. Failed traffic does not disconnect the tunnel with the Peer Timeout Profile values as it

does when IKE keepalives are enabled.

Note If you have a LAN-to-LAN configuration using IKE main mode, make sure that the two peers

have the same IKE keepalives configuration. Both peers must have IKE keepalives enabled or

both peers must have it disabled.

• Values for defining authorization usernames.

1 2 ... 412 413 414 415 416 417 418 419 420 421 422 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 417

Kommentare zu diesen Handbüchern