Configuring Policy Enforcement Points

This section contains the following topics covering the necessary configuration of the Policy Enforcement Points for implementing IPSec:

Result: The IPsec panel appears in the View pane.

Step 2 To specify which DES cipher is supported by this node, click that cipher in the list of ciphers in the DES Cipher Support box.

Two types of DES ciphers are available, depending on the type of software that is running on the selected node:

• DES. This option identifies that the node can support the standard DES cipher for IPsec-based communications, including the IKE authentication and the ESP payloads. If DES is not supported by the peer, the IPSec session request fails. All peers must, at a minimum, support the standard DES cipher.

• triple DES. This option identifies that the node can support the triple DES cipher. If a peer does not support triple DES, a node that supports triple DES can also support the standard DES cipher for the duration of a session.

Step 3 To accept your changes and close the selected panel, click OK.

Step 4 To save any changes that you have made, click Save on the File menu.

Result: The IPsec panel appears in the View pane.

Result: The Secret shared with peer label displays the name of the selected peer.

This list contains only those gateway objects and Cisco Secure Policy Manager hosts defined under the Network Topology tree that have the IPSec Support option selected in the General panel.

This secret identifies a valid secret that can be used by IKE to set up an IPSec tunnel between this node and the selected peer. The minimum length for this secret value is 8 characters and the maximum length is 128 alphanumeric characters. You cannot use Tab, Enter, spaces, question marks, or double quotes when defining this shared secret.

Result: The IPsec panel appears in the View pane.

Step 2 To specify which certificate authority server to use with this node, click that server in the list of certificate authority servers in the Trusted Certificate Authority Server box.

This value identifies a host defined in the Network Topology tree that has been configured to identify a certificate authority server by adding the Certificate Authority client-server product type to that host.

Step 3 To accept your changes and close the selected panel, click OK.

Step 4 To save any changes that you have made, click Save on the File menu.

Result: The IPsec panel appears in the View pane.

Step 2 To specify that you want to discover information about the certificates used by this node, click Discover.

Result: The Discovery dialog box appears with the IPSec box selected under the Discovery Selections box.

Step 3 To discover the certificate information and other IPSec settings for this node, click Discover.

Result: The Discovery Status box displays the status of the device discovery, including the time remaining before the discovery process aborts its discover attempt. When this process is complete, a message stating "Configuration completed. The configuration attempt was successful" appears. In addition, the Results button appears, which provides information about the discovery. Specifically, the Discovery Results dialog box should display the following messages:

• IPSec capability detected.

• Triple DES capability detected. (This message only appears if this node supports triple DES.)

• # certificates detected. (Where # is the number of certificates discovered on this node.)

Step 4 To close the Discovery dialog box, click OK.

Result: The IPSec panel now displays information about each certificate that was discovered. This information is organized on separate subtabs (below the Trusted Certificate Authority box) for each certificate that is discovered.

Step 5 To accept your changes and close the selected panel, click OK.

Step 6 To save any changes that you have made, click Save on the File menu.

Step 2 To view the Command panel, point to Properties, and then click Command on the shortcut menu.

Result: The Command panel appears in the View pane.

Step 3 To view the generated commands, click Pending Commands in the Command Review/Edit box.

Result: The list of commands that have been generated but not yet published to the selected Policy Enforcement Point appears in the Commands/Messages box.

Step 4 To find the IPSec bootstrap commands, scroll down the Commands/Messages box until you see the "IPSec bootstrap configuration" heading.

Step 5 Copy the list of commands that appears after the IPSec bootstrap configuration heading and paste it into a text file. On a console running Windows 95 or Windows NT, you can use Notepad. On a UNIX workstation, you can use vi.

Note If no commands appear after the IPSec bootstrap configuration heading, click Save and Update on the File menu or toolbar and verify that the policy generation processing has completed with no errors. To verify the policy generation, click Consistency Check on the Tools menu. If the commands still do not appear, make sure you selected an IPSec template in the Use secure IPSec with template field of the Policy Distribution Point box in the Enforcement panel.

Step 6 Delete the exclamation point (!) from the beginning of each line.

Tips You can use the search and replace function of your text editor, if available, to quickly remove all exclamation points.

Result: The command set is ready to be entered into the Policy Enforcement Point. If you will be accessing the Policy Enforcement Point from a workstation other than the one the GUI client is installed on, you will need to save to a location that is accessible from your point of access to the Policy Enforcement Point, such as a diskette or FTP server.

Step 7 Use a terminal console or Telnet session to access the Policy Enforcement Point. We recommend that you enter the bootstrap configuration information from a console terminal, because any information sent via Telnet is sent in clear text.

Step 8 Enter the configuration mode of the Policy Enforcement Point.

To enter configuration mode on a PIX Firewall or IOS Router with Firewall Feature Set:

a. At the EXEC mode prompt, type enable and press Enter.

Result: The Policy Enforcement Point enters the privileged EXEC mode. Depending upon the configuration of your Policy Enforcement Point, you may be required to enter a password before you are allowed to enter this mode.

b. To enter the global configuration mode, type config t and press Enter.

Result: The Policy Enforcement Point enters global configuration mode.

Step 9 To enter the configuration commands, copy the commands from the text file and paste them into your terminal or Telnet session. Do not paste the IPSec bootstrap configuration heading or the dashed lines that appear above and below the heading.

Result: The commands are entered, line by line, into the Policy Enforcement Point. The command set automatically places the Policy Enforcement Point into the proper configuration mode for each command being entered.

Step 10 Label and save the configuration file. If you ever need to revert back to standard communication between the Policy Distribution Point and the Policy Enforcement Point, you will need to manually issue the "no" version of the commands to remove the IPSec settings from the Policy Distribution Point.