Cisco PIX 500 Series Configuration Manual page 634

Configuring Connection Profiles
hostname(config-tunnel-ipsec)#
For example, the following command sets the trustpoint name to mytrustpoint:
hostname(config-tunnel-ipsec)# trust-point mytrustpoint
hostname(config-tunnel-ipsec)#
You can apply this attribute to all tunnel-group types.
Specify the ISAKMP(IKE) keepalive threshold and the number of retries allowed. The threshold
Step 6
parameter specifies the number of seconds (10 through 3600) that the peer is allowed to idle before
beginning keepalive monitoring. The retry parameter is the interval (2 through 10 seconds) between
retries after a keepalive response has not been received. IKE keepalives are enabled by default. To
disable IKE keepalives, enter the no form of the isakmp command:
hostname(config)# isakmp keepalive threshold < number > retry < number >
hostname(config-tunnel-ipsec)#
For example, the following command sets the ISAKMP keepalive threshold to 15 seconds and sets the
retry interval to 10 seconds.:
hostname(config-tunnel-ipsec)# isakmp keepalive threshold 15 retry 10
hostname(config-tunnel-ipsec)#
The default value for the threshold parameter for LAN-to-LAN is 10, and the default value for the retry
parameter is 2.
To specify that the central site ("head end") should never initiate ISAKMP monitoring, enter the
following command:
hostname(config-tunnel-ipsec)# isakmp keepalive threshold infinite
hostname(config-tunnel-ipsec)#
Specify the ISAKMP hybrid authentication method, XAUTH or hybrid XAUTH.
Step 7
You use isakmp ikev1-user-authentication command to implement hybrid XAUTH authentication
when you need to use digital certificates for security appliance authentication and a different, legacy
method for remote VPN user authentication, such as RADIUS, TACACS+ or SecurID. Hybrid XAUTH
breaks phase 1 of IKE down into the following two steps, together called hybrid authentication:
The security appliance authenticates to the remote VPN user with standard public key techniques.
a.
This establishes an IKE security association that is unidirectionally authenticated.
An XAUTH exchange then authenticates the remote VPN user. This extended authentication can use
b.
one of the supported legacy authentication methods.
Note
You can use the isakmp ikev1-user-authentication command with the optional interface parameter to
specify a particular interface. When you omit the interface parameter, the command applies to all the
interfaces and serves as a back-up when the per-interface command is not specified. When there are two
isakmp ikev1-user-authentication commands specified for a connection profile, and one uses the
interface parameter and one does not, the one specifying the interface takes precedence for that
particular interface.
For example, the following commands enable hybrid XAUTH on the inside interface for a connection
profile called example-group:
hostname(config)# tunnel-group example-group type remote-access
hostname(config)# tunnel-group example-group ipsec-attributes
Cisco Security Appliance Command Line Configuration Guide
30-18
Before the authentication type can be set to hybrid, you must configure the authentication server,
create a preshared key, and configure a trustpoint.
Chapter 30 Configuring Connection Profiles, Group Policies, and Users
OL-12172-03