Cisco PIX 525 Spécifications télécharger pdf (Page 218)

6-6

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 6 Configuring IPSec and Certification Authorities

Internet Key Exchange (IKE)

Default protection suite

encryption algorithm: DES - Data Encryption Standard (56 bit keys)

hash algorithm: Secure Hash Standard

authentication method: Rivest-Shamir-Adleman Signature

Diffie-Hellman group: #1 (768 bit)

lifetime: 86400 seconds, no volume limit

Note Although the output shows “no volume limit” for the lifetimes, you can currently only configure a time

lifetime (such as 86,400 seconds) with IKE; volume limit lifetimes are not currently configurable.

Disabling IKE

To disable IKE, you must make these concessions at the peers:

• All the IPSec security associations are manually specified in the crypto maps at all peers.

• IPSec security associations will never time out for a given IPSec session.

• The encryption keys never change during IPSec sessions between peers.

• Anti-replay services will not be available between the peers.

• CA support cannot be used.

To disable IKE, use the following command:

no crypto isakmp enable interface-name

For example:

no crypto isakmp enable outside

Using IKE with Pre-Shared Keys

If you use the IKE authentication method of pre-shared keys, manually configure these keys on the

PIX

Firewall and its peer(s). You can specify the same key to share with multiple peers, but it is more

secure to specify different keys to share between different pairs of peers. To configure a pre-shared key

on the PIX

Firewall, perform the following steps:

Step 1 Configure the PIX Firewall host name:

hostname newname

For example:

hostname mypixfirewall

In this example, “mypixfirewall” is the name of a unique host in the domain.

When two peers use IKE to establish IPSec security associations, each peer sends its identity to its peer.

Each peer’s identity is set either to its host name or its IP address. By default, the identity of the

PIX

Firewall is set to its IP address. If necessary, you can change the identity to be a host name instead.

As a general rule, set all peers’ identities the same way—either all peers should use their IP addresses

or all peers should use their host names. If some peers use their host names and some peers use their IP

addresses to identify themselves to one another, IKE negotiations could fail if a peer’s identity is not

recognized and a DNS lookup is unable to resolve the identity.

1 2 ... 213 214 215 216 217 218 219 220 221 222 223 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 218

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525