Cisco PIX 525 Spécifications télécharger pdf (Page 394)

100

101

23-6

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 23 Configuring IPSec and ISAKMP

Configuring ISAKMP

Disabling ISAKMP in Aggressive Mode

Phase 1 ISAKMP negotiations can use either main mode or aggressive mode. Both provide the same

services, but aggressive mode requires only two exchanges between the peers, rather than three.

Aggressive mode is faster, but does not provide identity protection for the communicating parties. It is

therefore necessary that they exchange identification information prior to establishing a secure SA in

which to encrypt in formation. Aggressive mode is enabled by default.

• Main mode is slower, using more exchanges, but it protects the identities of the communicating

peers.

• Aggressive mode is faster, but does not protect the identities of the peers.

To disable ISAKMP in aggressive mode, enter the following command:

isakmp am-disable

For example:

hostname(config)# isakmp am-disable

If you have disabled aggressive mode, and want to revert to back to it, use the no form of the command.

For example:

hostname(config)# no isakmp am-disable

Determining an ID Method for ISAKMP Peers

During Phase I ISAKMP negotiations the peers must identify themselves to each other. You can choose

the identification method from the following options:

The security appliance uses the Phase I ID to look up the tunnel group for the connection. This is trues

for all VPN scenarios except LAN-to-LAN connections in MM that authenticate with preshared keys.

To change the peer identification method from the default, hostname, enter the following command:

isakmp identity {address | hostname | key-id

id-string

| auto}

For example, the following command sets the identification method to automatic:

hostname(config)# isakmp identity auto

Address Uses the IP addresses of the hosts exchanging ISAKMP identity information

Automatic Determines ISAKMP negotiation by connection type:

• IP address for preshared key

• Cert DN for certificate authentication.

Hostname Uses the fully qualified domain name of the hosts exchanging ISAKMP identity

information (default). This name comprises the hostname and the domain name

Key ID Uses the string the remote peer uses to look up the preshared key

1 2 ... 389 390 391 392 393 394 395 396 397 398 399 ... 603 604

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 394

Commentaires sur ces manuels