Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 233)

6-21

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Using Dynamic Crypto Maps

crypto map mymap 10 set security-association lifetime seconds 2700

This example shortens the timed lifetime for the crypto map “mymap 10” to 2700 seconds

(45 minutes). The traffic volume lifetime is not changed.

f. (Optional) Specify that IPSec should ask for perfect forward secrecy (PFS) when requesting new

security associations for this crypto map entry, or should require PFS in requests received from the

peer:

crypto map map-name seq-num set pfs [group1 | group2 | group5]

Note Support for Diffie-Hellman group 5 is introduced with PIX Firewall version 6.3.

For example:

crypto map mymap 10 set pfs group2

This example specifies that PFS should be used whenever a new security association is negotiated

for the crypto map “mymap 10.” The 1024-bit Diffie-Hellman prime modulus group will be used

when a new security association is negotiated using the Diffie-Hellman exchange.

Step 4 Apply a crypto map set to an interface on which the IPSec traffic will be evaluated:

crypto map map-name interface interface-name

For example:

crypto map mymap interface outside

In this example, the PIX Firewall will evaluate the traffic going through the outside interface against the

crypto map “mymap” to determine whether it needs to be protected.

Step 5 Specify that IPSec traffic be implicitly trusted (permitted):

sysopt connection permit-ipsec

Diffie-Hellman Group 5

Diffie-Hellman is a public key operation that provides a method for two IPSec peers to agree on a key

to use. To perform the Diffie-Hellman operation, both sides must agree to use a number or group for the

mathematical calculation. Versions of PIX

Firewall prior to Version 6.3 support group 1 (768 bits) and

group 2 (1024 bits). PIX

Firewall Version 6.3 introduces support for Group 5 (1536 bits), which provides

higher security for the Diffie-Hellman operation. In version 6.3, PIX

Firewall also supports AES

(Advance Encryption Standard) which provides cryptographic keys of 256 bits and which requires the

use of Diffie-Hellman Group 5 keys.

Using Dynamic Crypto Maps

Dynamic crypto maps, used with IKE, can ease IPSec configuration and are recommended for use in

networks where the peers are not always predetermined. You use dynamic crypto maps for VPN clients

(such as mobile users) and routers that obtain dynamically assigned IP addresses. For an example of

using dynamic crypto maps in a remote access VPN configuration, see

Chapter 8, “Managing VPN

Remote Access.”

1 2 ... 228 229 230 231 232 233 234 235 236 237 238 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 233

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525