Cisco PIX 525 Spécifications télécharger pdf (Page 162)

4-10

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 4 Using PIX Firewall in SOHO Networks

Using PIX Firewall as an Easy VPN Remote Device

PIX Firewall Version 6.3 or higher lets you use Media Access Control (MAC) addresses to bypass

authentication for devices, such as Cisco IP Phones, that do not support this type of authentication. When

MAC-based AAA exemption is enabled, the PIX

Firewall bypasses the AAA server for traffic that

matches both the MAC address of the device and the IP address that has been dynamically assigned by

a DHCP server.

This feature, like IUA, is enabled or disabled on the Easy VPN Server. For information about enabling

this feature on a PIX

Firewall used as an Easy VPN Server, refer to the “Bypassing AAA Authentication”

section on page 8-5.

To configure this feature on a PIX Firewall used as an Easy VPN Remote device, refer to the “Using

MAC-Based AAA Exemption” section on page 3-13 in Chapter 3, “Controlling Network Access and

Use.”

Using X.509 Certificates

PIX Firewall Version 6.3 allows the use of IPsec Main Mode by providing RSA-SIG support for X.509

certificates.

Note To establish a VPN tunnel using certificates, an Easy VPN Server using Cisco IOS software needs to be

running IOS version 122-13.T1 or later. Earlier versions of Cisco IOS software do not support the

XAUTH RSA-SIG policy that is required for using certificates to establish a VPN tunnel.

With previous versions of PIX Firewall used as an Easy VPN Remote, IPSec Aggressive Mode was

required so that vpngroup to key mappings could be performed at the Easy VPN Server. With RSA-SIG

support, this restriction no longer applies and IPSec Main Mode can be used. Aggressive Mode is used

for pre-shared keys and Main Mode is used for RSA-SIG based key exchange.

With PIX Firewall Version 6.3, the default option is RSA-SIG. To use pre-shared keys, enter the

following command:

vpnclient vpngroup groupname password preshared_key

PIX Firewall Version 6.3 introduces additional encryption options for use by the Easy VPN Remote.

These include Advanced Encryption Standard (AES) and Diffie-Hellman Group 5. Use of these

protocols is determined by licensing (3DES, AES) and the use of Main Mode or Aggressive Mode.

Diffie-Hellman groups are negotiable only in Main Mode.

Note A PIX Firewall used as an Easy VPN Remote device does not check to determine if the certificate of the

Easy VPN Server is revoked.

PIX Firewall Version 6.3 introduces optional X.500 support. The certificate enrollment process is

enhanced to configure X.500 directory content.

To configure X.500 directory content, enter the following command:

ca subject-name ca-nickname [x500_DN]

You can either enter the full X.500 distinguished name (DN) or if this parameter is omitted, the

PIX

Firewall prompts you for the required information.

For example, the following command includes the DN:

pixfirewall(config)# ca subject-name cn=pixfirewall.example.com,ou=VSEC BU,o=Cisco

System,c=US,[email protected]

1 2 ... 157 158 159 160 161 162 163 164 165 166 167 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 162

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525