Cisco ISA550, Руководство администратора

Страница: 291 / 427

VPN
Configuring a Site-to-Site VPN
Cisco ISA500 Series Integrated Security Appliances Administration Guide 291
8
This section describes how to set up the site-to-site VPN tunnels. Refer to the
following topics:
• Configuration Tasks to Establish a Site-to-Site VPN Tunnel, page 291
• General Site-to-Site VPN Settings, page 292
• Configuring IPsec VPN Policies, page 293
• Configuring IKE Policies, page 299
• Configuring Transform Sets, page 301
• Remote Teleworker Configuration Examples, page 302
Configuration Tasks to Establish a Site-to-Site VPN Tunnel
To establish a site-to-site VPN tunnel, complete the following configuration tasks:
• Add the subnet IP address objects for your local network and remote
network. See
Address Management, page 173 .
• (Optional) Import the certificates for authentication between two peers.
Skip this step if you want to use the pre-shared key for authentication. See
Managing Certificates for Authentication, page 368 .
• Enable the site-to-site VPN feature on the security appliance. See General
Site-to-Site VPN Settings, page 292 .
• Configure IKE policies. See Configuring IKE Policies, page 299 .
• Configure transform policies. See Configuring Transform Sets, page 301 .
• Configure IPsec VPN policies. See Configuring IPsec VPN Policies,
page 293 .
• (Optional) Check an enabled IPsec VPN policy and click the Connect icon
to initiate the VPN connection.
When a site-to-site IPsec VPN policy is in place and enabled, a connection
will be triggered by any traffic that matches the policy. In this case, the VPN
tunnel will be set up automatically. However, for an IPsec VPN policy in which
this router’s Remote Network is set to Any (a “site-to-any” tunnel), a
connection cannot be set up automatically. Instead you must manually
establish the VPN connection by clicking the
Connect icon.
• View the status and statistic information for all IPsec VPN sessions. See
Viewing IPsec VPN Status, page 286 .