Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 300)

8-20

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 8 Managing VPN Remote Access

Using PPTP for Remote Access

Overview

The firewall provides support for Microsoft PPTP, which is an alternative to IPSec handling for VPN

clients. While PPTP is less secure than IPSec, PPTP may be easier in some networks to implement and

maintain.

The vpdn command implements the PPTP feature for inbound connections between the firewall and a

Windows client. Point-to-Point Tunneling Protocol (PPTP) is a Layer 2 tunneling protocol, which lets a

remote client use a public IP network to communicate securely with servers at a private corporate

network. PPTP tunnels the IP protocol. RFC 2637 describes the PPTP protocol.

Support is provided for only inbound PPTP and only one firewall interface can have the vpdn command

enabled.

Supported authentication protocols include: PAP, CHAP, and MS-CHAP using external AAA (RADIUS

or TACACS+) servers or the firewall local username and password database. Through the PPP IPCP

protocol negotiation, the firewall assigns a dynamic internal IP address to the PPTP client allocated from

a locally defined IP address pool.

The firewall PPTP VPN supports standard PPP CCP negotiations with Microsoft Point-To-Point

Encryption (MPPE) extensions using RSA/RC4 algorithm. MPPE currently supports 40-bit and 128-bit

session keys. MPPE generates an initial key during user authentication and refreshes the key regularly.

In this release, compression is not supported.

When you specify MPPE, use the MS-CHAP PPP authentication protocol. If you are using an external

AAA server, the protocol should be RADIUS and the external RADIUS server should be able to return

the Microsoft MSCHAP_MPPE_KEY attribute to the firewall in the RADIUS Authentication Accept

packet. See RFC 2548, “Microsoft Vendor Specific RADIUS Attributes,” for more information on the

MSCHAP_MPPE_KEY attribute.

Cisco Secure ACS 2.5/2.6 and higher releases support the MS-CHAP/MPPE encryption.

The firewall PPTP VPN has been tested with the following Microsoft Windows products: Windows 95

with DUN1.3, Windows 98, Windows NT 4.0 with SP6, and Windows 2000.

Note If you configure the firewall for 128-bit encryption and if a Windows 95 or Windows 98 client does not

support 128-bit or greater encryption, then the connection to the firewall is refused. When this occurs,

the Windows client moves the dial-up connection menu down to the screen corner while the PPP

negotiation is in progress. This gives the appearance that the connection is accepted when it is not. When

the PPP negotiation completes, the tunnel terminates and the firewall ends the connection. The Windows

client eventually times out and disconnects.

PPTP Configuration

Use the vpdn command with the sysopt connection permit-pptp command to allow PPTP traffic to

bypass checking of access-list command statements.

The show vpdn command lists tunnel and session information.

The clear vpdn command removes all vpdn commands from the configurations and stops all the active

PPTP tunnels. The clear vpdn all command lets you remove all tunnels, and the clear vpdn id tunnel_id

command lets you remove tunnels associated with tunnel_id. (You can view the tunnel_id with the show

vpdn command.)

1 2 ... 295 296 297 298 299 300 301 302 303 304 305 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 300

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525