Cisco 500 Series, Руководство по настройке

Страница: 576 / 1140

27-14
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 27 Configuring IPSec and ISAKMP
Configuring IPSec
ACEs containing deny statements filter out outbound traffic that does not require IPSec protection
(for example, routing protocol traffic). Therefore, insert initial deny statements to filter outbound traffic
that should not be evaluated against permit statements in a crypto access list.
For an inbound, encrypted packet, the security appliance uses the source address and ESP SPI to
determine the decryption parameters. After the security appliance decrypts the packet, it compares the
inner header of the decrypted packet to the permit ACEs in the ACL associated with the packet SA. If the
inner header fails to match the proxy, the security appliance drops the packet. It the inner header matches
the proxy, the security appliance routes the packet.
When comparing the inner header of an inbound packet that was not encrypted, the security appliance
ignores all deny rules because they would prevent the establishment of a Phase 2 SA.
Note To route inbound, unencrypted traffic as clear text, insert deny ACEs before permit ACEs.
Figure 27-1 shows an example LAN-to-LAN network of security appliances.
Table 27-2 Special Meanings of Permit and Deny in Crypto Access Lists Applied to Outbound
Traffic
Result of Crypto Map
Evaluation
Response
Match criterion in an ACE
containing a permit statement Halt further evaluation of the packet against the remaining ACEs in the
crypto map set, and evaluate the packet security settings against those in
the transform sets assigned to the crypto map. After matching the
security settings to those in a transform set, the security appliance
applies the associated IPSec settings. Typically for outbound traffic, this
means that it decrypts, authenticates, and routes the packet.
Match criterion in an ACE
containing a deny statement Interrupt further evaluation of the packet against the remaining ACEs in
the crypto map under evaluation, and resume evaluation against the
ACEs in the next crypto map, as determined by the next seq-num
assigned to it.
Fail to match all tested permit
ACEs in the crypto map set Route the packet without encrypting it.