Cisco PIX 525 Especificações descarregar pdf (Página 417)

B-13

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Appendix B Configuration Examples for Other Remote Access Clients

Windows 2000 Client with IPSec and L2TP

This command is stored in the configuration. 1 is the retry period, 20 is the retry count, and the

crloptional option disables CRL checking.

Step 7 Authenticate the CA by obtaining its public key and its certificate:

ca authenticate abcd

This command is entered at the command line and does not get stored in the configuration.

Step 8 Request signed certificates from your CA for your PIX Firewall’s RSA key pair:

ca enroll abcd cisco

Before entering this command, contact your CA administrator because they must authenticate your

PIX

Firewall manually before granting its certificate(s).

“cisco” is a challenge password. This can be anything. This command is entered at the command line

and does not get stored in the configuration.

Step 9 Verify that the enrollment process was successful using the show ca certificate command:

show ca certificate

Step 10 Save keys and certificates, and the CA commands (except those indicated) in Flash memory:

ca save all

write memory

Note Use the ca save all command any time you add, change, or delete ca commands in the

configuration. This command is not stored in the configuration.

Step 11 Configure the IKE policy:

isakmp policy 1 authentication rsa-sig

isakmp policy 1 encryption des

isakmp policy 1 hash sha

isakmp policy 1 group 1

isakmp policy 1 lifetime 86400

Note Always configure the IKE lifetime on PIX Firewall for the same or more time than the IKE

lifetime configured on the Windows 2000 L2TP/IPSec client, or the IKE negotiation will fail

(CSCdt 48570).

Step 12 Configure ISAKMP identity:

isakmp identity hostname

Step 13 Enable ISAKMP on the outside interface:

isakmp enable outside

Step 14 Create an access list that defines the PIX Firewall network(s) requiring IPSec protection:

access-list 90 permit ip 10.0.0.0 255.255.255.0 10.1.1.0 255.255.255.0

Step 15 Bind the access list to NAT 0:

nat (inside) 0 access-list 90

1 2 ... 412 413 414 415 416 417 418 419 420 421 422 ... 465 466

Sem comentários

Cisco PIX 525 Especificações Página 417