Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 234)

6-22

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Using Dynamic Crypto Maps

Note Use care when using the any keyword in permit command entries in dynamic crypto maps. If it is

possible for the traffic covered by such a permit command entry to include multicast or broadcast traffic,

the access list should include deny command entries for the appropriate address range. Access lists

should also include deny command entries for network and subnet broadcast traffic, and for any other

traffic that should not be IPSec protected.

Dynamic crypto maps can only be used for negotiating SAs with remote peers that initiate the

connection. They cannot be used for initiating connections to a remote peer. With a dynamic crypto map

entry, if outbound traffic matches a permit statement in an access list and the corresponding security

association is not yet established, the PIX

Firewall will drop the traffic.

A dynamic crypto map entry is essentially a crypto map entry without all the parameters configured. It

acts as a policy template where the missing parameters are later dynamically configured (as the result of

an IPSec negotiation) to match a peer’s requirements. This allows peers to exchange IPSec traffic with

the PIX

Firewall even if the PIX Firewall does not have a crypto map entry specifically configured to

meet all the peer’s requirements.

Note Only the transform-set parameter is required to be configured within each dynamic crypto map entry.

A dynamic crypto map set is included by reference as part of a crypto map set. Any crypto map entries

that reference dynamic crypto map sets should be the lowest priority crypto map entries in the crypto

map set (that is, have the highest sequence numbers) so that the other crypto map entries are evaluated

first; that way, the dynamic crypto map set is examined only when the other (static) map entries are not

successfully matched.

If the PIX Firewall accepts the peer’s request at the point that it installs the new IPSec security

associations, it also installs a temporary crypto map entry. This entry is filled in with the results of the

negotiation. At this point, the PIX

Firewall performs normal processing, using this temporary crypto

map entry as a normal entry, even requesting new security associations if the current ones are expiring

(based upon the policy specified in the temporary crypto map entry). Once the flow expires (that is, all

the corresponding security associations expire), the temporary crypto map entry is then removed.

Dynamic crypto map entries, like regular static crypto map entries, are grouped into sets. A set is a group

of dynamic crypto map entries all with the same dynamic-map-name but each with a different

dynamic-seq-num. If this is configured, the data flow identity proposed by the IPSec peer should fall

within a permit statement for this crypto access list. If this is not configured, the PIX

Firewall will

accept any data flow identity proposed by the peer.

You can add one or more dynamic crypto map sets into a crypto map set via crypto map entries that

reference the dynamic crypto map sets. You should set the crypto map entries referencing dynamic maps

to be the lowest priority entries in a crypto map set (that is, use the highest sequence numbers).

Note Use care when using the any keyword in permit entries in dynamic crypto maps. If it is possible for the

traffic covered by such a permit entry to include multicast or broadcast traffic, the access list should

include deny entries for the appropriate address range. Access lists should also include deny entries for

network and subnet broadcast traffic, and for any other traffic that should not be IPSec protected.

The procedure for using a crypto dynamic map entry is the same as the basic configuration described in

“

Basic IPSec Configuration,” except that instead of creating a static crypto map entry, you create a crypto

dynamic map entry. You can also combine static and dynamic map entries within a single crypto map set.

Create a crypto dynamic map entry by performing the following steps:

1 2 ... 229 230 231 232 233 234 235 236 237 238 239 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 234

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525