Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 437)

25-23

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Group Policies

Step 28 Configure backup servers if you plan on using them. IPSec backup servers let a VPN client connect to

the central site when the primary security appliance is unavailable. To configure backup servers, enter

the backup-servers command in group-policy configuration mode.

hostname(config-group-policy)# backup-servers {

server1 server2... server10

clear-client-config | keep-client-config}

When you configure backup servers, the security appliance pushes the server list to the client as the

IPSec tunnel is established. Backup servers do not exist until you configure them, either on the client or

on the primary security appliance.

To remove a backup server, enter the no form of this command. To remove the backup-servers attribute

from the running configuration and enable inheritance of a value for backup-servers from another group

policy, enter the no form of this command without arguments.

hostname(config-group-policy)# no backup-servers [server1 server2... server10 |

clear-client-config | keep-client-config]

The clear-client-config keyword specifies that the client uses no backup servers. The security appliance

pushes a null server list.

The keep-client-config keyword specifies that the security appliance sends no backup server

information to the client. The client uses its own backup server list, if configured. This is the default.

The server1 server 2.... server10 parameter list is a space-delimited, priority-ordered list of servers for

the VPN client to use when the primary security appliance is unavailable. This list identifies servers by

IP address or hostname. The list can be 500 characters long, but it can contain only 10 entries.

Configure backup servers either on the client or on the primary security appliance. If you configure

backup servers on the security appliance, it pushes the backup server policy to the clients in the group,

replacing the backup server list on the client if one is configured.

Note If you are using hostnames, it is wise to have backup DNS and WINS servers on a separate

network from that of the primary DNS and WINS servers. Otherwise, if clients behind a

hardware client obtain DNS and WINS information from the hardware client via DHCP, and the

connection to the primary server is lost, and the backup servers have different DNS and WINS

information, clients cannot be updated until the DHCP lease expires. In addition, if you use

hostnames and the DNS server is unavailable, significant delays can occur.

The following example shows how to configure backup servers with IP addresses 10.10.10.1 and

192.168.10.14, for the group policy named “FirstGroup”:

hostname(config)# group-policy FirstGroup attributes

hostname(config-group-policy)# backup-servers 10.10.10.1 192.168.10.14

Step 29 Set personal firewall policies that the security appliance pushes to the VPN client during IKE tunnel

negotiation by using the client-firewall command in group-policy configuration mode. To delete a

firewall policy, enter the no form of this command.

To delete all firewall policies, enter the no client-firewall command without arguments. This command

deletes all configured firewall policies, including a null policy if you created one by entering the

client-firewall command with the none keyword.

When there are no firewall policies, users inherit any that exist in the default or other group policy. To

prevent users from inheriting such firewall policies, enter the client-firewall command with the none

keyword.

1 2 ... 432 433 434 435 436 437 438 439 440 441 442 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 437

Kommentare zu diesen Handbüchern