Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 421)

100

101

25-7

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Configuring Tunnel Groups

Step 5 Specify the preshared key to support IKE connections based on preshared keys.

hostname(config-ipsec)# pre-shared-key xyzx

The preceding command specifies the preshared key xyzx to support IKE connections for an IPSec

remote access tunnel group:

Step 6 Specify whether to validate the identity of the peer using the peer’s certificate:

hostname(config-ipsec)# peer-id-validate

option

The available options are req (required), cert (if supported by certificate), and nocheck (do not check).

The default is req.

Step 7 Specify whether to enable sending of a certificate chain. The following command includes the root

certificate and any subordinate CA certificates in the transmission:

hostname(config-ipsec)# chain

You can apply this attribute to all tunnel-group types.

Step 8 Specify the name of a trustpoint that identifies the certificate to be sent to the IKE peer:

hostname(config-ipsec)# trust-point

trust-point-name

The following command specifies “mytrustpoint” as the name of the certificate to be sent to the IKE

peer:

hostname(config-ipsec)# trust-point mytrustpoint

You can apply this attribute to all tunnel-group types.

Step 9 Specify whether to have the security appliance use MS-CHAPv2 to negotiate a password update with the

user during authentication:

hostname(config-ipsec)# radius-with-expiry

The security appliance ignores this command if RADIUS authentication has not been configured.

Step 10 ISAKMP keepalive threshold and the number of retries allowed.

hostname(config)# isakmp keepalive threshold <

number

> retry <

number

The threshold parameter specifies the number of seconds (10 through 3600) that the peer is allowed to

idle before beginning keepalive monitoring. The retry parameter is the interval (2 through 10 seconds)

between retries after a keepalive response has not been received. IKE keepalives are enabled by default.

To disable IKE keepalives, enter the no form of the isakmp command:

For example, the following command sets the IKE keepalive threshold value to 15 seconds and sets the

retry interval to 10 seconds:

hostname(config-ipsec)# isakmp keepalive threshold 15 retry 10

The default value for the threshold parameter is 300 for remote-access and 10 for LAN-to-LAN, and the

default value for the retry parameter is 2.

1 2 ... 416 417 418 419 420 421 422 423 424 425 426 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 421

Kommentare zu diesen Handbüchern