Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 229)

6-17

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Configuring IPSec

(In other words, it does not allow the policy as specified in this crypto map entry to be applied to this

traffic.) If this traffic is denied in all the crypto map entries for that interface, the traffic is not protected

by crypto IPSec.

The crypto access list you define will be applied to an interface after you define the corresponding crypto

map entry and apply the crypto map set to the interface. Different access lists should be used in different

entries of the same crypto map set. However, both inbound and outbound traffic will be evaluated against

the same “outbound” IPSec access list.

Therefore, the access list’s criteria are applied in the forward direction to traffic exiting your

PIX

Firewall, and the reverse direction to traffic entering your PIX Firewall. In Figure 6-1, IPSec

protection is applied to traffic between Host 10.0.0.1 and Host 10.2.2.2 as the data exits PIX Firewall

A’s outside interface toward Host 10.2.2.2. For traffic from Host 10.0.0.1 to Host 10.2.2.2, the access list

entry on PIX

Firewall A is evaluated as follows:

source = host 10.0.0.1

dest = host 10.2.2.2

For traffic from Host 10.2.2.2 to Host 10.0.0.1, that same access list entry on PIX Firewall A is evaluated

as follows:

source = host 10.2.2.2

dest = host 10.0.0.1

Figure 6-1 How Crypto Access Lists Are Applied for Processing IPSec

IPSec peers

34791

Internet

outside outside

PIX Firewall A PIX Firewall B

Host

10.0.0.1

Host

10.2.2.2

IPSec Access List at "outside" interface:

access-list 101 permit ip host 10.0.0.1 host 10.2.2.2

IPSec Access List at "outside" interface:

access-list 111 permit ip host 10.2.2.2 host 10.0.0.1

Traffic exchanged between hosts 10.0.0.1 and 10.2.2.2

is protected between PIX Firewall A "outside" and PIX Firewall B "outside"

If you configure multiple statements for a given crypto access list that is used for IPSec, in general the

first permit statement that is matched will be the statement used to determine the scope of the IPSec

security association. That is, the IPSec security association will be set up to protect traffic that meets the

criteria of the matched statement only. Later, if traffic matches a different permit statement of the crypto

access list, a new, separate IPSec security association will be negotiated to protect traffic matching the

newly matched access list statement.

Any unprotected inbound traffic that matches a permit entry in the crypto access list for a crypto map

entry flagged as IPSec will be dropped because this traffic was expected to be protected by IPSec.

Access lists for crypto map entries tagged as ipsec-manual are restricted to a single permit entry and

subsequent entries are ignored. In other words, the security associations established by that particular

crypto map entry are only for a single data flow. To support multiple manually established security

1 2 ... 224 225 226 227 228 229 230 231 232 233 234 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 229

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525