This task consists of several steps to determine IKE and
IPSec policies, ensure the network works before encryption, and ensure the PIX
Firewall can support IPSec. Successful implementation of an IPSec network
requires advance preparation before beginning configuration of individual
devices.
Configuring IPSec encryption can be complicated and, at times,
confusing. To reduce both, it’s essential to plan ahead. If you get in a hurry,
this can only lead to lost time and frustration. Because this process was
defined in detail in Chapter 10, it won’t be repeated here. Follow these basic
planning steps:
Step 1.1: Determine IKE (IKE Phase one) policy
to be used between IPSec peers, including whether to use preshared keys or
CAs.
Step 1.2: Determine IPSec (IKE Phase two)
policy, including the IPSec peer details, such as IP addresses and IPSec modes
to be used when configuring the crypto maps.
Step 1.3: Check the current configuration to see
if IPSec is currently being used on the devices. Use the write
terminal, show isakmp [policy], show crypto
map, and other show commands covered later in this
chapter.
Step 1.4: Verify the network works without
encryption. Verify basic connectivity among all devices with the ping command.
|
Note |
All Cisco documentation includes this step, but it seems
this should be Step 1. Without basic connectivity, the rest is just spinning
your wheels. Consider it in “real world”
implementations. |
Step 1.5: Make sure any access lists are
compatible with IPSec. Verify perimeter routers and the PIX Firewall outside
interfaces permit IPSec traffic. Implicitly permit IPSec packets to bypass PIX
Firewall access lists and conduits. Use the show access-lists
command.
|
Note |
As you learned in the VPN chapters, there might only be four
or five major tasks, but each task can have a similar number of steps. To make
this easier to track, we’ll again use a decimal notation to link tasks, steps,
and substeps. For example, Step 1.5 indicates Task 1 Step 5. If Step 1.5 had
multiple parts, they would be noted by a second decimal (Step 1.5.3). |
Sections
Comments (0 posted)
Syndication
