Cisco PIX 525 Spécifications Page 134
- Page / 466
- Table des matières
- MARQUE LIVRES
Noté. / 5. Basé sur avis des utilisateurs
3-22
Cisco PIX Firewall and VPN Configuration Guide
78-15033-01
Chapter 3 Controlling Network Access and Use
Downloading Access Lists
Step 3 Configure a Cisco Secure ACS user or a group through User Setup or Group Setup to include the
defined ACL in the user or group settings.
Once the configuration is properly configured, a user authentication request will first cause the access
list name to be sent to the PIX
Firewall. The PIX Firewall will determine if the named ACL already
exists and if not, the PIX
Firewall will request the ACL to be downloaded. A named ACL is not
downloaded again as long as it exists on the PIX
Firewall.
If the download is successful, the ACL on the PIX Firewall will have the following name:
#ACSACL#-acl_name-12345678
Where acl_name is the name for the access list defined in the SPC and 12345678 is a unique version ID.
If the named access list is not configured on ACS or the download fails for any other reason, a Syslog
message will be logged.
After the ACL definition has been downloaded to the PIX Firewall, it looks like the following:
access-list #ACSACL#-PIX-acs_ten_acl-3b5385f7 permit tcp any host 10.0.0.254
access-list #ACSACL#-PIX-acs_ten_acl-3b5385f7 permit udp any host 10.0.0.254
access-list #ACSACL#-PIX-acs_ten_acl-3b5385f7 permit icmp any host 10.0.0.254
access-list #ACSACL#-PIX-acs_ten_acl-3b5385f7 permit tcp any host 10.0.0.253
access-list #ACSACL#-PIX-acs_ten_acl-3b5385f7 permit udp any host 10.0.0.253
access-list #ACSACL#-PIX-acs_ten_acl-3b5385f7 permit icmp any host 10.0.0.253
access-list #ACSACL#-PIX-acs_ten_acl-3b5385f7 permit tcp any host 10.0.0.252
access-list #ACSACL#-PIX-acs_ten_acl-3b5385f7 permit udp any host 10.0.0.252
access-list #ACSACL#-PIX-acs_ten_acl-3b5385f7 permit icmp any host 10.0.0.252
access-list #ACSACL#-PIX-acs_ten_acl-3b5385f7 permit ip any any
Step 4 Activate the use of downloadable ACLs by performing the following steps:
a. Click Interface Configuration on the Cisco Secure ACS main menu.
b. Click Advanced Options on the Interface Configuration menu.
c. Select either or both of the following options:
–
User-Level Downloadable ACLs
–
Group-Level Downloadable ACLs
Downloading an Access List Without a Name
To download an access list without using a name during a user authentication, perform the following at
a AAA RADIUS server:
Configure CISCO-specific VSA (Attribute 26) string of a user authentication profile in the following
format:
ip:inacl#nnn=ACL_COMMAND
where:
• ip:inacl# is the string that specifies an input ACL.
• nnn is a number in the range from 0 to 999999999 that identifies the order of the access-list
command statement to be configured on the PIX
Firewall. If this parameter is omitted, the
sequence value is 0.
• ACL_COMMAND represents one ore more PIX Firewall access-list commands.
- Cisco PIX Firewall and VPN 1
- Configuration Guide 1
- CONTENTS 3
- Contents 10
- 78-15033-01 10
- INDEXndex 18
- About This Guide 19
- Document Organization 20
- Document Conventions 21
- Obtaining Documentation 21
- Documentation CD-ROM 22
- Ordering Documentation 22
- Documentation Feedback 22
- Cisco.com 23
- Technical Assistance Center 23
- Cisco TAC Escalation Center 24
- Getting Started 27
- How the PIX Firewall Works 28
- Adaptive Security Algorithm 29
- Address Translation 31
- Cut-Through Proxy 32
- Supported Routing Protocols 32
- Access Control 32
- TurboACL 33
- Downloadable ACLs 33
- VLAN Support 34
- Mail Guard 35
- Flood Guard 35
- DNS Control 35
- ActiveX Blocking 36
- Java Filtering 36
- URL Filtering 36
- Configurable Proxy Pinging 36
- Voice over IP 37
- CTIQBE (TAPI) 38
- RAS Version 2 38
- LDAP Version 2 and ILS 40
- NetBIOS over IP 40
- Virtual Private Networks 41
- Certification Authorities 42
- Using a Site-to-Site VPN 43
- DHCP Server 45
- DHCP Relay 46
- DHCP Client 46
- Using a Syslog Server 49
- FTP and URL Logging 49
- Integration with Cisco IDS 49
- PIX Firewall Failover 50
- Access Modes 51
- Accessing Configuration Mode 52
- Abbreviating Commands 53
- Command Line Editing 54
- Filtering Show Command Output 54
- Command Output Paging 55
- Comments 55
- Configuration Size 56
- Help Information 56
- Where to Go from Here 57
- Establishing Connectivity 61
- Setting Default Routes 63
- How NAT and PAT Work 70
- Configuring NAT and PAT 70
- Using RIP 73
- PIX Firewall 74
- Using OSPF 75
- OSPF Features Supported 76
- Restrictions and Limitations 77
- Using OSPF in Public Networks 78
- Viewing OSPF Configuration 81
- Clearing OSPF Configuration 82
- Testing Connectivity 83
- Basic Configuration Examples 85
- Internet 90
- 209.165.201.3209.165.201.2 92
- 192.168.0.110.0.0.3 92
- 209.165.201.1 92
- 209.165.201.4 92
- Using VLANs with the Firewall 94
- Using Logical Interfaces 95
- VLAN Security Issues 96
- Managing VLANs 97
- Using Outside NAT 98
- Simplifying Routing 99
- 209.165.200.225 100
- 209.165.200.226 100
- Policy NAT 101
- Limitations 104
- Configuring Policy NAT 104
- Overview 106
- Configuring IGMP Timers 109
- Clearing IGMP Configuration 109
- Viewing and Debugging SMR 110
- • RFC 2236 IGMPv2 111
- • RFC 2362 PIM-SM 111
- Enabling Inbound Connections 114
- 10.1.1.2 209.165.201.25 118
- PAT address = 118
- 209.165.201.15 118
- Inside Outside 118
- Port Redirection Example 119
- Configuring AAA 120
- Using MAC-Based AAA Exemption 125
- Basic Configuration 126
- Managing Access to Services 128
- Using TurboACL 130
- Globally Configuring TurboACL 131
- Downloading Access Lists 132
- Software Restrictions 135
- How Object Grouping Works 136
- Using Subcommand Mode 137
- Nesting Object Groups 141
- Removing Object Groups 142
- Filtering ActiveX Objects 143
- Filtering Java Applets 144
- Filtering HTTPS and FTP Sites 146
- Configuring Filtering Policy 147
- Filtering Long URLs 148
- Configuration Procedure 150
- Basic Configuration Procedure 156
- • Overview, page 4-7 158
- Using X.509 Certificates 162
- Using Related Commands 168
- Using DHCP Relay 173
- Configuring the DHCP Client 174
- • debug dhcpc packet 175
- • debug dhcpc detail 175
- • debug dhcpc error 175
- Using the fixup Command 180
- Basic Internet Protocols 182
- • ESP tunnel serialization 186
- • SPI matching 186
- Application Inspection 188
- Sample Configuration 189
- Voice Over IP 190
- CU-SeeMe 191
- Viewing Connection Status 193
- Technical Background 193
- Viewing MGCP Information 196
- Using PAT with SCCP 197
- Viewing SCCP Information 199
- Providing IP Address Privacy 201
- Instant Messaging (IM) 202
- Viewing SIP Information 202
- Multimedia Applications 203
- TCP Stream 205
- VDO LIVE 206
- ILS and LDAP 207
- Step 2 Permit NFS access: 208
- Management Protocols 209
- Remote Shell 210
- How IPSec Works 213
- Internet Key Exchange (IKE) 214
- Configuring IKE 216
- Disabling IKE 218
- CA Overview 220
- Public Key Cryptography 220
- Supported CA Servers 221
- Configuring IPSec 225
- Transform Sets 226
- Crypto Maps 226
- Access Lists 228
- IPSec SA Lifetimes 230
- Basic IPSec Configuration 231
- Using Dynamic Crypto Maps 233
- Site-to-Site Redundancy 236
- Using NAT Traversal 236
- Manual Configuration of SAs 237
- Viewing IPSec Configuration 240
- Clearing SAs 240
- Using Pre-Shared Keys 243
- Figure 7-1 VPN Tunnel Network 244
- Step 1 Define a host name: 244
- Scenario Description 249
- Figure 7-2 VPN Tunnel Network 250
- Step 11 Define a crypto map: 261
- PIX Firewall 1 Configuration 263
- PIX Firewall 2 Configuration 265
- Services Module 267
- Manual Configuration with NAT 277
- Managing VPN Remote Access 281
- Enabling Redundancy 284
- Bypassing AAA Authentication 285
- Configuring the PIX Firewall 290
- Using PPTP for Remote Access 299
- PPTP Configuration 300
- PPTP Configuration Example 301
- Privilege Levels 304
- User Authentication 305
- Command Authorization 307
- TACACS+ Command Authorization 310
- Recovering from Lockout 311
- Using Network Time Protocol 312
- Enabling NTP 313
- Viewing System Time 317
- Setting the System Clock 317
- option is 318
- Using Telnet 322
- Trace Channel Feature 323
- Obtaining an SSH Client 324
- Viewing SSH Status 326
- Enabling Auto Update Support 327
- Managing Auto Update Support 328
- Capturing Packets 329
- Packet Capture Output Formats 331
- Packet Capture Examples 332
- Using Syslog 334
- Disabling Syslog Messages 336
- Configuration 337
- Logging Behavior 339
- Syslog Message Format 340
- Managing IDS Syslog Messages 341
- Using SNMP 343
- MIB Support 344
- SNMP CPU Utilization 344
- SNMP Usage Notes 345
- SNMP Traps 346
- Viewing Failover Status 349
- Verifying Memory Usage 350
- Viewing The Connection Count 351
- Viewing System Buffer Usage 352
- Using PIX Firewall Failover 355
- Failover System Requirements 356
- Understanding Failover 357
- Failover and State Links 358
- State Link 359
- Configuration Replication 360
- Failover Triggers 361
- Configuring the Primary Unit 366
- Forcing Failover 374
- Disabling Failover 374
- Monitoring Failover 375
- Basic Failover Questions 377
- LAN-Based Failover Questions 379
- Stateful Failover Questions 379
- Cable-Based Failover Example 380
- LAN-Based Failover Example 381
- Obtaining an Activation Key 384
- Entering a New Activation Key 384
- 1. Install the new image 385
- 2. Reboot the system 385
- 4. Reboot the system 385
- Getting a TFTP Server 389
- Downloading Software with FTP 390
- Using Boothelper 392
- TFTP Download Error Codes 397
- Acronyms and Abbreviations 399
- Access Clients 405
- Introduction 406
- PIX Firewall Configuration 407
- Token Enabled 408
- Next Tokencode Mode 408
- New PIN Mode 409
- L2TP Overview 413
- Tunnel mode 414
- Transport mode 414
- Enabling IPSec Debug 419
- Figure B-5 VPN Client Access 420
- APPENDIX 427
- Configuring the Inside Server 429
- TCP/IP Reference Information 431
- Protocols and Applications 435
- Using Subnet Masks 437
- Uses for Subnet Information 439
- Using Limited IP Addresses 439
- Addresses in the .128 Mask 439
- Addresses in the .192 Mask 440
- Addresses in the .224 Mask 440
- Addresses in the .240 Mask 440
- Addresses in the .248 Mask 441
- Addresses in the .252 Mask 442
- Proposals 445
- Supported Easy VPN Proposals 447
Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525
(105 pages)© 2020, manymanuals.fr. Tous droits réservés | 0.118 s |
Manymanuals.com
Manymanuals.de
Manymanuals.fr
Manymanuals.it
Manymanuals.pl
Manymanuals.cz
Manymanuals.es
Manymanuals-pt.com
Commentaires sur ces manuels