Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 286)

8-6

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 8 Managing VPN Remote Access

Configuring Extended Authentication (Xauth)

Note The IKE Mode Config feature also is negotiated between IKE Phase 1 and 2. If both features are

configured, Xauth is performed first.

The Xauth feature is optional and is enabled using the crypto map map-name client authentication

aaa-group-tag command. AAA must be configured on the PIX

Firewall using the aaa-server group_tag

(if_name) host server_ip key timeout seconds command before Xauth is enabled. Use the same AAA

server name within the aaa-server and crypto map client authentication command statements. See the

aaa-server command and the crypto map command in the Cisco PIX Firewall Command Reference for

more information.

Follow these steps to configure Xauth on your PIX Firewall:

Step 1 Set up your basic AAA Server:

aaa-server group_tag (if_name) host server_ip key

For example:

aaa-server TACACS+ (outside) host 10.0.0.2 secret123

This example specifies that the authentication server with the IP address 10.0.0.2 resides on the outside

interface and is in the default TACACS+ server group. The key “secret123” is used between the

PIX

Firewall and the TACACS+ server for encrypting data between them.

Step 2 Enable Xauth. Be sure to specify the same AAA server group tag within the crypto map client

authentication command statement as was specified in the aaa-server command statement.

crypto map map-name client authentication aaa-group-tag

For example:

crypto map mymap client authentication TACACS+

In this example, Xauth is enabled at the crypto map “mymap” and the server specified in the TACACS+

group will be used for user authentication.

Step 3 (Optional) Perform this step for each site-to-site VPN peer that shares the same interface as the VPN

client(s) and is configured to use a pre-shared key. This step allows the PIX

Firewall to make an

exception to the Xauth feature for the given site-to-site VPN peer.

isakmp key keystring address ip-address [netmask mask] [no-xauth] [no-config-mode]

For example:

isakmp key secretkey1234 address 10.2.2.2 netmask 255.255.255.255 no-xauth

Step 4 (Optional) To make an exception to the Xauth feature for the given site-to-site VPN peer, enter the

following command:

isakmp peer fqdn fqdn [no-xauth] [no-config-mode]

Perform this step for each site-to-site VPN peer that shares the same interface as the VPN client(s) and

is configured to use RSA-signatures.

For example:

isakmp peer fqdn hostname1.example.com no-xauth

1 2 ... 281 282 283 284 285 286 287 288 289 290 291 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 286

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525