Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 464)

28-6

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 28 Configuring LAN-to-LAN VPNs

Creating a Crypto Map and Applying It To an Interface

Step 2 To set the authentication method to preshared key, enter the ipsec-attributes mode and then enter the

pre-shared-key command to create the preshared key. You need to use the same preshared key on both

security appliances for this LAN-to-LAN connection.

The key is an alphanumeric string of 1-128 characters. In the following example the preshared key is

44kkaol59636jnfx.

hostname(config)# tunnel-group 10.10.4.108 ipsec-attributes

hostname(config-ipsec)# pre-shared-key 44kkaol59636jnfx

Step 3 Save your changes.

hostname(config)# write memory

hostname(config)#

Creating a Crypto Map and Applying It To an Interface

Crypto map entries pull together the various elements of IPSec security associations, including the

following:

• Which traffic IPSec should protect, which you define in an access list.

• Where to send IPSec-protected traffic, by identifying the peer.

• What IPSec security applies to this traffic, which a transform set specifies.

• The local address for IPSec traffic, which you identify by applying the crypto map to an interface.

For IPSec to succeed, both peers must have crypto map entries with compatible configurations. For two

crypto map entries to be compatible, they must, at a minimum, meet the following criteria:

• The crypto map entries must contain compatible crypto access lists (for example, mirror image

access lists). If the responding peer uses dynamic crypto maps, the entries in the security appliance

crypto access list must be “permitted” by the peer’s crypto access list.

• The crypto map entries each must identify the other peer (unless the responding peer is using a

dynamic crypto map).

• The crypto map entries must have at least one transform set in common.

If you create more than one crypto map entry for a given interface, use the sequence number (seq-num)

of each entry to rank it: the lower the seq-num, the higher the priority. At the interface that has the crypto

map set, the security appliance evaluates traffic against the entries of higher priority maps first.

Create multiple crypto map entries for a given interface if either of the following conditions exist:

• Different peers handle different data flows.

• You want to apply different IPSec security to different types of traffic (to the same or separate peers),

for example, if you want traffic between one set of subnets to be authenticated, and traffic between

another set of subnets to be both authenticated and encrypted. In this case, define the different types

of traffic in two separate access lists, and create a separate crypto map entry for each crypto access

list.

To create a crypto map and apply it to the outside interface in global configuration mode, enter several

of the crypto map commands. These commands use a variety of arguments, but the syntax for all of them

begin with crypto map map-name-seq-num. In the following example the map-name is abcmap, the

sequence number is 1.

1 2 ... 459 460 461 462 463 464 465 466 467 468 469 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 464

Kommentare zu diesen Handbüchern