Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 461)

100

101

28-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 28 Configuring LAN-to-LAN VPNs

Configuring ISAKMP Policy and Enabling ISAKMP on the Outside Interface

To set the terms of the ISAKMP negotiations, you create an ISAKMP policy, which includes the

following:

• An authentication method, to ensure the identity of the peers.

• An encryption method, to protect the data and ensure privacy.

• A Hashed Message Authentication Codes method to ensure the identity of the sender and to ensure

that the message has not been modified in transit.

• A Diffie-Hellman group to establish the strength of the encryption-key-determination algorithm.

The security appliance uses this algorithm to derive the encryption and hash keys.

• A time limit for how long the security appliance uses an encryption key before replacing it.

See on page 23-3 in the “Configuring IPSec and ISAKMP” chapter of this guide for detailed information

about the IKE policy keywords and their values.

To configure ISAKMP policies, in global configuration mode use the isakmp policy command with its

various arguments. The syntax for ISAKMP policy commands is as follows:

isakmp policy priority attribute_name [attribute_value | integer].

Perform the following steps and use the command syntax in the following examples as a guide.

Step 1 Set the authentication method. The following example configures a preshared key. The priority is 1 in

this and all following steps.

hostname(config)# isakmp policy 1 authentication pre-share

hostname(config)#

Step 2 Set the encryption method. The following example configures 3DES.

hostname(config)# isakmp policy 1 encryption 3des

hostname(config)#

Step 3 Set the HMAC method. The following example configures SHA-1.

hostname(config)# isakmp policy 1 hash sha

hostname(config)#

Step 4 Set the Diffie-Hellman group. The following example configures Group 2.

hostname(config)# isakmp policy 1 group 2

hostname(config)#

Step 5 Set the encryption key lifetime. The following example configures 43,200 seconds (12 hours).

hostname(config)# isakmp policy 1 lifetime 43200

hostname(config)#

Step 6 Enable ISAKMP on the interface named outside.

hostname(config)# isakmp enable outside

hostname(config)#

Step 7 To save your changes, enter the write memory command.

hostname(config)# write memory

hostname(config)#

1 2 ... 456 457 458 459 460 461 462 463 464 465 466 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 461

Kommentare zu diesen Handbüchern