Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 239)

6-27

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Manual Configuration of SAs

Step 5 Set the AH SPIs and keys to apply to outbound protected traffic:

crypto map map-name seq-num set session-key outbound ah spi hex-key-data

For example:

crypto map mymaptwo 30 set session-key outbound ah 400

123456789A123456789A123456789A123456789A

Step 6 If the specified transform set includes the ESP protocol, set the ESP SPIs and keys to apply to inbound

protected traffic. If the transform set includes an ESP cipher algorithm, specify the cipher keys. If the

transform set includes an ESP authenticator algorithm, specify the authenticator keys.

crypto map map-name seq-num set session-key inbound esp spi cipher hex-key-data

[authenticator hex-key-data]

For example:

crypto map mymaptwo 30 set session-key inbound esp 300 cipher 1234567890123456

authenticator 0000111122223333444455556666777788889999

Step 7 Set the ESP SPIs and keys to apply to outbound protected traffic. If the transform set includes an ESP

cipher algorithm, specify the cipher keys. If the transform set includes an ESP authenticator algorithm,

specify the authenticator keys.

crypto map map-name seq-num set session-key outbound esp spi cipher hex-key-data

[authenticator hex-key-data]

For example:

crypto map mymaptwo 30 set session-key outbound esp 300 cipher abcdefghijklmnop

authenticator 9999888877776666555544443333222211110000

Step 8 Apply a crypto map set to an interface on which the IPSec traffic will be evaluated:

crypto map map-name interface interface-name

For example:

crypto map mymap interface outside

In this example, the PIX Firewall will evaluate the traffic going through the outside interface against the

crypto map “mymap” to determine whether it needs to be protected.

Step 9 Specify that IPSec traffic be implicitly trusted (permitted):

sysopt connection permit-ipsec

Note This command also permits L2TP/IPSec traffic.

1 2 ... 234 235 236 237 238 239 240 241 242 243 244 ... 465 466

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 239