Cisco ISR 4000 Family Routers Administrator Guidance
Page
40
of
66
4.6.5 Information Flow Policies
The TOE may be configured by the privileged administrators for information flow control/ firewall
rules as well as VPN capabilities using the access control functionality. Configuration of
information flow policies is restricted to the privileged administrator.
The VPNGW Extended Package requires that the TOE be able to support options for information
flow policies that include discarding, bypassing, and protecting. On the TOE, an authorized
administrator can define the traffic rules on the box by configuring access lists (with permit, deny,
and/or log actions) and applying these access lists to interfaces using access and crypto map sets:
The ‘discard’ option is accomplished using access lists with deny entries, which are
applied to interfaces within access-groups. Guidance for configuration of IOS
Information Flow Policies is located in the
[11]
Under “Zone-based Policy Firewalls”
or “Zone-Based Policy Firewall IPv6 Support”
for IPv6.
The ‘bypassing’ option is accomplished using access lists with deny entries, which are
applied to interfaces within crypto maps for IPsec and the ‘filter tunnel’ command for
SSL VPN. Guidance for configuration of entries for IPsec is in [12]
The ‘protecting’ option is accomplished using access lists with permit entries, which
are applied to interfaces within crypto maps for IPsec and the ‘filter tunnel’ command
for SSL VPN.
The criteria used in matching traffic in all of these access lists includes the source and destination
address, and optionally the Layer 4 protocol and port.
The TOE enforces information flow policies on network packets that are receive by TOE interfaces
and leave the TOE through other TOE interfaces. When network packets are received on a TOE
interface, the TOE verifies whether the network traffic is allowed or not and performs one of the
following actions, pass/not pass information, as well as optional logging.
4.7
Product Updates
Verification of authenticity of updated software is done in the same manner as ensuring that the
TOE is running a valid image. See Section 2, steps 7 and 9 above for the method to download and
verify an image prior to running it on the TOE.
Configure Reference Identifier
This section describes configuration of the peer reference identifier which is achieved through a
certificate map.
Certificate maps provide the ability for a certificate to be matched with a given set of criteria. You
can specify which fields within a certificate should be checked and which values those fields may
or may not have. There are six logical tests for comparing the field with the value: equal, not equal,
contains, does not contain, less than, and greater than or equal. ISAKMP and ikev2 profiles can
bind themselves to certificate maps, and the TOE will determine if they are valid during IKE
authentication.
Step1 (config)#
crypto pki certificate map
label sequence-number
Starts certificate-map mode
