Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 215)

6-3

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Internet Key Exchange (IKE)

IKE negotiations must be protected, so each IKE negotiation begins by each peer agreeing on a common

(shared) IKE policy. This policy states the security parameters that will be used to protect subsequent

IKE negotiations. After the two peers agree upon a policy, the security parameters of the policy are

identified by an SA established at each peer, and these SAs apply to all subsequent IKE traffic during

the negotiation.

There are five parameters to define in each IKE policy. These parameters apply to the IKE negotiations

when the IKE SA is established.

Table 6-1 provides the five IKE policy keywords and their permitted

values.

Ta b l e 6-1 IKE Policy Keywords

Keyword Meaning Description

des

3des

aes

aes-192

ase-256

56-bit DES-CBC

168-bit Triple DES

Specifies the symmetric encryption algorithm used to

protect user data transmitted between two IPSec peers. The

default is 56-bit DES-CBC, which is less secure and faster

than the alternatives.

The Advanced Encryption Standard is introduced with

PIX

Firewall version 6.3 and supports three different key

lengths of 128, 192, 256 bytes.

sha

md5

SHA-1 (HMAC variant)

MD5 (HMAC variant)

Specifies the hash algorithm used to ensure data integrity.

The default is SHA-1. MD5 has a smaller digest and is

considered to be slightly faster than SHA-1. There has been

a demonstrated successful (but extremely difficult) attack

against MD5; however, the HMAC variant used by IKE

prevents this attack.

rsa-sig

pre-share

RSA signatures

pre-shared keys

Specifies the method of authentication used to establish the

identity of each IPSec peer. The default, RSA signatures,

provide non-repudiation for the IKE negotiation (you can

prove to a third party after the fact that you had an IKE

negotiation with a specific peer). Pre-shared keys do not

scale well with a growing network but are easier to set up

in a small network.

For further information about the two authentication

methods, refer to the following sections:

• “Using IKE with Pre-Shared Keys”

• “Using Certification Authorities”

Group 1 (768-bit

Diffie-Hellman)

Group 2 (1024-bit

Diffie-Hellman)

Group 5 (1536-bit

Diffie-Hellman)

Specifies the Diffie-Hellman group identifier, which is

used by the two IPSec peers to derive a shared secret

without transmitting it to each other. The default, Group 1

(768-bit Diffie-Hellman) requires less CPU time to execute

but is less secure than Group 2 (1024-bit Diffie-Hellman).

Support for Diffie-Hellman Group 5 is introduced with

PIX

Firewall Version 6.3.

integer value 120 to 86,400 seconds Specifies the SA lifetime. The default is 86,400 seconds or

24 hours. As a general rule, a shorter lifetime (up to a point)

provides more secure IKE negotiations. However, with

longer lifetimes, future IPSec security associations can be

set up more quickly.

1 2 ... 210 211 212 213 214 215 216 217 218 219 220 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 215

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525