Cisco PIX 525 Spécifications télécharger pdf (Page 216)

6-4

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Internet Key Exchange (IKE)

There is an implicit trade-off between security and performance when you choose a specific value for

each parameter. The level of security provided by the default values is adequate for the security

requirements of most organizations. If you are interoperating with a peer that supports only one of the

values for a parameter, your choice is limited to the other peer’s supported value.

You can create multiple IKE policies, each with a different combination of parameter values. For each

policy that you create, you assign a unique priority (1 through 65,534, with 1 being the highest priority).

If you do not configure any policies, your PIX

Firewall will use the default policy, which is always set

to the lowest priority, and which contains each parameter’s default value. If you do not specify a value

for a specific parameter, the default value is assigned.

When the IKE negotiation begins, the peer that initiates the negotiation will send all its policies to the

remote peer, and the remote peer will try to find a match. The remote peer checks each of its policies in

order of its priority (highest priority first) until a match is found.

A match is made when both policies from the two peers contain the same encryption, hash,

authentication, and Diffie-Hellman parameter values, and when the remote peer’s policy specifies a

lifetime less than or equal to the lifetime in the policy being compared. If the lifetimes are not identical,

the shorter lifetime—from the remote peer’s policy—will be used. If no acceptable match is found, IKE

refuses negotiation and the IKE SA will not be established.

Configuring IKE

To enable and configure IKE, perform the following steps:

Note If you do not specify a value for a given policy parameter, the default value is assigned.

Step 1 Identify the policy to create. Each policy is uniquely identified by the priority number you assign.

isakmp policy priority

For example:

isakmp policy 20

Step 2 Specify the encryption algorithm:

isakmp policy priority encryption aes | aes-192 | aes-256 | des | 3des

For example:

isakmp policy 20 encryption des

Step 3 Specify the hash algorithm:

isakmp policy priority hash md5 | sha

For example:

isakmp policy 20 hash md5

Step 4 Specify the authentication method:

isakmp policy priority authentication pre-share | rsa-sig

For example:

isakmp policy 20 authentication rsa-sig

1 2 ... 211 212 213 214 215 216 217 218 219 220 221 ... 465 466

Pas de commentaire

Cisco PIX 525 Spécifications Page 216