Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 444)

25-30

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 25 Configuring Tunnel Groups, Group Policies, and Users

Configuring Users

You configure ACLs to permit or deny various types of traffic for this user. You then use the vpn-filter

command to apply those ACLs.

hostname(config-username)# vpn-filter {value

ACL name

| none}

hostname(config-username)# no vpn-filter

The following example shows how to set a filter that invokes an access list named “acl_vpn” for the user

named “anyuser”:

hostname(config)# username anyuser attributes

hostname(config-username)# vpn-filter value acl_vpn

Step 8 Specify the IP address and netmask to assign to a particular user. To remove the IP address, enter the no

form of this command.

hostname(config-username)# vpn-framed-ip-address {

ip_address

}

hostname(config-username)# no vpn-framed-ip-address

The following example shows how to set an IP address of 10.92.166.7 for a user named “anyuser”:

hostname(config)# username anyuser attributes

hostname(config-username)# vpn-framed-ip-address 10.92.166.7

Step 9 Specify the network mask to use with the IP address specified in the previous step. If you used the

no vpn-framed-ip-address command, do not specify a network mask. To remove the subnet mask, enter

the no form of this command. There is no default behavior or value.

hostname(config-username)# vpn-framed-ip-netmask {

netmask

}

hostname(config-username)# no vpn-framed-ip-netmask

The following example shows how to set a subnet mask of 255.255.255. 254 for a user named “anyuser”:

hostname(config)# username anyuser attributes

hostname(config-username)# vpn-framed-ip-netmask 255.255.255.254

Step 10 Specify the VPN tunnel types (IPSec) that this user can use. The default is taken from the default group

policy, the default for which is IPSec. To remove the attribute from the running configuration, enter the

no form of this command.

hostname(config-username)# vpn-tunnel-protocol IPSec

hostname(config-username)# no vpn-tunnel-protocol [IPSec]

The parameter values for this command are as follows:

• IPSec—Negotiates an IPSec tunnel between two peers (a remote access client or another secure

gateway). Creates security associations that govern authentication, encryption, encapsulation, and

key management.

Enter this command to configure one or more tunneling modes. You must configure at least one tunneling

mode for users to connect over a VPN tunnel.

The following example shows how to configure IPSec tunneling mode for the user named “anyuser”:

hostname(config)# username anyuser attributes

hostname(config-username)# vpn-tunnel-protocol IPSec

Step 11 Configure the group-lock attribute with the value keyword to restrict remote users to access only

through the specified, preexisting tunnel group. To remove the group-lock attribute from the running

configuration, enter the no form of this command. This option allows inheritance of a value from the

group policy. To disable group-lock, and to prevent inheriting a group-lock value from a default or

specified group policy, enter the group-lock command with the none keyword.

1 2 ... 439 440 441 442 443 444 445 446 447 448 449 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 444

Kommentare zu diesen Handbüchern