Cisco 500 Series, Руководство по настройке

Страница: 713 / 1140

32-3
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 32 Configuring Remote Access IPSec VPNs
Configuring ISAKMP Policy and Enabling ISAKMP on the Outside Interface
Configuring ISAKMP Policy and Enabling ISAKMP on the
Outside Interface
The Internet Security Association and Key Management Protocol, also called IKE, is the negotiation
protocol that lets two hosts agree on how to build an IPSec Security Association. Each ISAKMP
negotiation is divided into two sections called Phase1 and Phase2.
Phase 1 creates the first tunnel to protect later ISAKMP negotiation messages. Phase 2 creates the tunnel
that protects data travelling across the secure connection.
To set the terms of the ISAKMP negotiations, you create an ISAKMP policy. It includes the following:
• An authentication method, to ensure the identity of the peers.
•
An encryption method, to protect the data and ensure privacy.
• A Hashed Message Authentication Codes method to ensure the identity of the sender and to ensure
that the message has not been modified in transit.
•
A Diffie-Hellman group to set the size of the encryption key.
• A time limit for how long the security appliance uses an encryption key before replacing it.
See on page 27-3 in the “Configuring IPSec and ISAKMP” chapter of this guide for detailed information
about the IKE policy keywords and their values.
To configure ISAKMP policies, in global configuration mode, enter the isakmp policy command with
its various arguments. The syntax for ISAKMP policy commands is
isakmp policy priority attribute_name [attribute_value | integer ] .
Perform the following steps and use the command syntax in the following examples as a guide.
Step 1
Set the authentication method. The following example configures preshared key. The priority is 1 in this
and all following steps.
hostname(config)# isakmp policy 1 authentication pre-share
hostname(config)#
Step 2 Set the encryption method. The following example configures 3DES.
hostname(config)# isakmp policy 1 encryption 3des
hostname(config)#
Step 3
Set the HMAC method. The following example configures SHA-1.
hostname(config)# isakmp policy 1 hash sha
hostname(config)#
Step 4 Set the Diffie-Hellman group. The following example configures Group 2.
hostname(config)# isakmp policy 1 group 2
hostname(config)#
Step 5
Set the encryption key lifetime. The following example configures 43,200 seconds (12 hours).
hostname(config)#
isakmp policy 1 lifetime 43200
hostname(config)#
Step 6 Enable ISAKMP on the interface named outside.
hostname(config)# isakmp enable outside
hostname(config)#