Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 449)

26-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 26 Configuring IP Addresses for VPNs

Configuring an IP Address Assignment Method

To configure AAA for IP addressing, perform the following steps:

Step 1 To configure AAA as the address assignment method, enter the vpn-addr-assign command with the aaa

argument:

hostname(config)# vpn-addr-assign aaa

hostname(config)#

Step 2 To establish the tunnel group called firstgroup as a remote access or LAN-to-LAN tunnel group, enter

the tunnel-group command with the type keyword. The following example configures a remote access

tunnel group.

hostname(config)# tunnel-group firstgroup type ipsec-ra

hostname(config)#

Step 3 To enter general-attributes configuration mode, which lets you define a AAA server group for the tunnel

group called firstgroup, enter the tunnel-group command with the general-attributes argument.

hostname(config)# tunnel-group firstgroup general-attributes

hostname(config-general)#

Step 4 To specify the AAA server group to use for authentication, enter the authentication-server-group

command.

hostname(config-general)# authentication-server-group RAD2

hostname(config-general)#

This command has more arguments that this example includes. For more information, see the

Cisco Security Appliance Command Reference.

Configuring DHCP Addressing

To use DHCP to assign addresses for VPN clients, you must first configure a DHCP server and the range

of IP addresses that the DHCP server can use. Then you define the DHCP server on a tunnel group basis.

Optionally, you can also define a DHCP network scope in the group policy associated with the tunnel

group or username. This is either an IP network number or IP Address that identifies to the DHCP server

which pool of IP addresses to use.

The following examples define the DHCP server at IP address 172.33.44.19 for the tunnel group named

firstgroup. They also define a DHCP network scope of 192.86.0.0 for the group policy called

remotegroup. (The group policy called remotegroup is associated with the tunnel group called

firstgroup). If you do not define a network scope, the DHCP server assigns IP addresses in the order of

the address pools configured. It goes through the pools until it identifies an unassigned address.

The following configuration includes more steps than are necessary, in that previously you might have

named and defined the tunnel group type as remote access, and named and identified the group policy

as internal or external. These steps appear in the following examples as a reminder that you have no

access to subsequent tunnel-group and group-policy commands until you set these values.

A summary of the configuration that these examples create follows:

hostname(config)# vpn-addr-assign dhcp

hostname(config)# tunnel-group firstgroup type ipsec-ra

hostname(config)# tunnel-group firstgroup general-attributes

hostname(config-general)# dhcp-server 172.33.44.19

hostname(config-general)# exit

hostname(config)# group-policy remotegroup internal

1 2 ... 444 445 446 447 448 449 450 451 452 453 454 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 449

Kommentare zu diesen Handbüchern