Cisco ASA 5508-X, Руководство по настройке, Страница: 92 / 428

6-10
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 6 ASA and Cisco TrustSec
About Cisco TrustSec
Scalability
The following table shows the number of IP-SGT mapping entries that the ASA supports.
The following table shows the number of SXP connections that the ASA supports.
Register the ASA with the ISE
The ASA must be configured as a recognized Cisco TrustSec network device in the ISE before the ASA
can successfully import a PAC file. To register the ASA with the ISE, perform the following steps:
1.
Log into the ISE.
2.
Choose Administration > Network Devices > Network Devices .
3.
Click Add .
4.
Enter the IP address of the ASA.
5.
When the ISE is being used for user authentication, enter a shared secret in the Authentication
Settings area.
When you configure the AAA sever on the ASA, provide the shared secret that you create here on
the ISE. The AAA server on the ASA uses this shared secret to communicate with the ISE.
6.
Specify a device name, device ID, password, and a download interval for the ASA. See the ISE
documentation for how to perform these tasks.
Create a Security Group on the ISE
When configuring the ASA to communicate with the ISE, you specify a AAA server. When configuring
the AAA server on the ASA, you must specify a server group. The security group must be configured to
use the RADIUS protocol. To create a security group on the ISE, perform the following steps:
1.
Log into the ISE.
Table 6-1 Capacity Numbers for IP-SGT Mapping Entries
ASA Model Number of IP-SGT Mapping Entries
5585-X with SSP-10 18,750
5585-X with SSP-20 25,000
5585-X with SSP-40 50,000
5585-X with SSP-60 100,000
Table 6-2 SXP Connections
ASA Model Number of SXP TCP Connections
5585-X with SSP-10 150
5585-X with SSP-20 250
5585-X with SSP-40 500
5585-X with SSP-60 1000