Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 230)

6-18

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Configuring IPSec

associations for different kinds of traffic, define multiple crypto access lists, and apply each one to a

separate ipsec-manual crypto map command entry. Each access list should include one permit

statement defining which traffic to protect.

Note If you clear or delete the last element from an access list, the crypto map references to the destroyed

access list are also removed.

If you modify an access list that is currently referenced by one or more crypto map entries, the run-time

security association database will need to be re initialized using the crypto map interface command.

See the crypto map command page for more information.

We recommend that for every crypto access list specified for a static crypto map entry that you define at

the local peer, you define a “mirror image” crypto access list at the remote peer. This ensures that traffic

that has IPSec protection applied locally can be processed correctly at the remote peer. (The crypto map

entries themselves should also support common transforms and refer to the other system as a peer.)

Note Every static crypto map must define an access list and an IPsec peer. If either is missing, the crypto map

is considered incomplete and any traffic that has not already been matched to an earlier, complete crypto

map is dropped. Use the show conf command to ensure that every crypto map is complete. To fix an

incomplete crypto map, remove the crypto map, add the missing entries, and reapply it.

When you create crypto access lists, using the any keyword could cause problems. We discourage the

use of the any keyword to specify source or destination addresses.

The permit any any command statement is strongly discouraged, as this will cause all outbound traffic

to be protected (and all protected traffic sent to the peer specified in the corresponding crypto map entry)

and will require protection for all inbound traffic. Then, all inbound packets that lack IPSec protection

will be silently dropped.

You must be sure that you define which packets to protect. If you use the any keyword in a permit

command statement, preface that statement with a series of deny command statements to filter out any

traffic (that would otherwise fall within that permit command statement) that you do not want to be

protected.

IPSec SA Lifetimes

You can change the global lifetime values that are used when negotiating new IPSec security

associations. (These global lifetime values can be overridden for a particular crypto map entry.)

These lifetimes only apply to security associations established via IKE. Manually established security

associations do not expire.

There are two lifetimes: a “timed” lifetime and a “traffic-volume” lifetime. A security association

expires after the respective lifetime is reached and negotiations will be initiated for a new one. The

default lifetimes are 28,800 seconds (eight hours) and 4,608,000 kilobytes (10 megabytes per second for

one hour).

If you change a global lifetime, the new lifetime value will not be applied to currently existing security

associations, but will be used in the negotiation of subsequently established security associations. If you

wish to use the new values immediately, you can clear all or part of the security association database.

See the clear [crypto] ipsec sa command for more information within the crypto ipsec command page

of Cisco PIX

Firewall Command Reference.

1 2 ... 225 226 227 228 229 230 231 232 233 234 235 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 230

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525