Cisco PIX 525 Spécifications télécharger pdf (Page 462)

100

101

28-4

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 28 Configuring LAN-to-LAN VPNs

Creating a Transform Set

A transform set combines an encryption method and an authentication method. During the IPSec security

association negotiation with ISAKMP, the peers agree to use a particular transform set to protect a

particular data flow. The transform set must be the same for both peers.

You can create multiple transform sets, and then specify one or more of these transform sets in a crypto

map entry. The security appliance uses the transform set to protect the data flows for that crypto map

entry access list.

Table 28-1 lists valid encryption and authentication methods.

Tunnel Mode is the usual way to implement IPSec between two security appliances that are connected

over an untrusted network, such as the public Internet. Tunnel mode is the default and requires no

configuration.

To configure a transform set, perform the following steps:

Step 1 In global configuration mode enter the crypto ipsec transform-set command. The following example

configures a transform set with the name FirstSet, esp-3des encryption, and esp-md5-hmac

authentication. The syntax is as follows:

crypto ipsec transform-set transform-set-name encryption-method authentication-method

hostname(config)# crypto ipsec transform-set FirstSet esp-3des esp-md5-hmac

hostname(config)#

Step 2 Save your changes.

hostname(config)# write memory

hostname(config)#

Configuring an ACL

The security appliance uses access control lists to control network access. By default, the security

appliance denies all traffic. You need to configure an ACL that permits traffic.

The ACLs that you configure for this LAN-to-LAN VPN control connections are based on the source

and destination IP addresses. Configure ACLs that mirror each other on both sides of the connection.

Table 28-1 Encryption and Authentication Methods

Valid Encryption Methods Valid Authentication Methods

esp-des esp-md5-hmac

esp-3des (default) esp-sha-hmac (default)

esp-aes (128-bit encryption)

esp-aes-192

esp-aes-256

esp-null

1 2 ... 457 458 459 460 461 462 463 464 465 466 467 ... 603 604

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 462

Commentaires sur ces manuels