Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 420)

25-6

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Configuring Tunnel Groups

Step 8 Whether users must exist in the authorization database to connect.

hostname(config)# authorization-server-group

groupname

Configure Remote-Access Tunnel Group IPSec Attributes

To configure the IPSec attributes, specify the following parameters:

Step 1 Specify the IPSec-attributes designator:

hostname(config)# tunnel-group

tunnel-group-name

ipsec-attributes

For example, the following command designates that the config-ipsec mode commands that follow

pertain to the tunnel group named “TG1”:

hostname(config)# tunnel-group TG1 ipsec-attributes

This command enters config-ipsec mode, in which you configure the tunnel-group IPSec attributes.

Step 2 Specify the attribute or attributes to use in deriving a name for an authorization query from a certificate.

This attribute specifies what part of the subject DN field to use as the username for authorization:

hostname(config-ipsec)# authorization-dn-attributes {

primary-attribute

[

secondary-attribute

] | use-entire-name}

For example, the following command specifies the use of the “CN” attribute as the username for

authorization:

hostname(config-ipsec)# authorization-dn-attributes CN

The authorization-dn-attributes are C (Country), CN (Common Name), DNQ (DN qualifier), EA

(E-mail Address), GENQ (Generational qualifier), GN (Given Name), I (Initials), L (Locality),

N (Name), O (Organization), OU (Organizational Unit), SER (Serial Number), SN (Surname),

SP (State/Province), T (Title), and UID (User ID)

Step 3 Specify whether to require a successful authorization before allowing a user to connect. The default is

not to require authorization.

hostname(config-ipsec)# authorization-required

Step 4 Specify the client-update parameters; that is, the client type and the acceptable revision levels for that

client:

hostname(config-ipsec)# client-update type

type

url

url-string

rev-nums

rev-numbers

The available client types are Win9X (includes Windows 95, Windows 98 and Windows ME platforms),

WinNT (includes Windows NT 4.0, Windows 2000 and Windows XP platforms), Windows (Includes

all Windows based platforms), and vpn3002 (VPN3002 hardware client).

If the client is already running a software version on the list of revision numbers, it does not need to

update its software. If the client is not running a software version on the list, it should update. You can

specify up to four of these client update entries.

The following example configures client update parameters for the remote-access tunnel-group. It

designates the revision number, 4.6.1 and the URL for retrieving the update, which is

“https://support/updates”:

hostname(config-ipsec)# client-update type windows url https://support/updates/ rev-nums

4.6.1

1 2 ... 415 416 417 418 419 420 421 422 423 424 425 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 420

Kommentare zu diesen Handbüchern