Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 41)

1-15

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 1 Getting Started

Creating a Virtual Private Network

Virtual Private Networks

Virtual Private Networks (VPNs) let you securely interconnect geographically distributed users and sites

over the public Internet. VPNs can provide lower cost, improved reliability, and easier administration

than traditional wide-area networks based on private Frame Relay or dial-up connections. VPNs

maintain the same security and management policies as a private network. With a VPN, customers,

business partners, and remote users, such as telecommuters, can access enterprise computing resources

securely.

IPSec is a standard that defines vendor-independent methods of establishing a VPN. As part of its

security functions, the PIX

Firewall provides IPSec standards-based VPN capability. With IPSec, data

can be transmitted across a public network without fear of observation, modification, or spoofing.

Site-to-site and remote access VPNs are the two main types of VPN, both of which are supported by the

PIX

Firewall.

IPSec

IPSec provides security for transmission of sensitive information over unprotected networks such as the

Internet. IPSec acts at the network layer, protecting and authenticating IP packets between participating

IPSec devices (peers), such as PIX

Firewall units.

IPSec provides the following network security services:

• Data Confidentiality—The IPSec sender can encrypt packets before transmitting them across a

network.

• Data Integrity—The IPSec receiver can authenticate packets sent by the IPSec sender to ensure that

the data has not been altered during transmission.

• Data Origin Authentication—The IPSec receiver can authenticate the source of the IPSec packets

sent. This service is dependent upon the data integrity service.

• Anti-Replay—The IPSec receiver can detect and reject replayed packets.

Note The term data authentication is generally used to mean data integrity and data origin authentication.

Within this chapter, it also includes anti-replay services, unless otherwise specified.

IPSec provides secure tunnels between two peers, such as two PIX Firewall units. You define which

packets are considered sensitive and should be sent through these secure tunnels, and you define the

parameters that should be used to protect these sensitive packets, by specifying the characteristics of

these tunnels. Then, when the IPSec peer sees such a sensitive packet, it sets up the appropriate secure

tunnel and sends the packet through the tunnel to the remote peer. The secure tunnel used to transmit

information is based on encryption keys and other security parameters, described by security

associations (SAs).

Note PIX Firewall Version 6.3 introduces support for the Advanced Encryption Standard (AES) and

Diffie-Hellman Group 5.

Internet Key Exchange (IKE)

The process by which IPSec can automatically establish a secure tunnel is divided into two phases:

1 2 ... 36 37 38 39 40 41 42 43 44 45 46 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 41

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525