Cisco 7604 Configuration Guide - Page 715

Glossary NTLM NTP NT Lan Manager. A Microsoft Windows challenge-response authentication method. Network time protocol. O Oakley object grouping OSPF OU outbound outbound ACL outside A key exchange protocol that defines how to acquire authenticated keying material. The basic mechanism for Oakley is the Diffie-Hellman key exchange algorithm. Oakley is defined in RFC 2412. Simplifies access control by letting you apply access control statements to groups of network objects, such as protocol, services, hosts, and networks. Open Shortest Path First. OSPF is a routing protocol for IP networks. OSPF is a routing protocol widely deployed in large networks because of its efficient use of network bandwidth and its rapid convergence after changes in topology. The FWSM supports OSPF. Organizational Unit. An X.500 directory attribute. Refers to traffic whose destination is on an interface with lower security than the source interface. An ACL applied to outbound traffic. The first interface, usually port 0, that connects to other "untrusted" networks outside the FWSM; the Internet. See also interface, interface names, outbound. P PAC PAT Perfmon PFS Phase 1 Phase 2 PPTP Access Concentrator. A device attached to one or more PSTN or ISDN lines capable of PPP operation and of handling the PPTP protocol. The PAC need only implement TCP/IP to pass traffic to one or more PNSs. It may also tunnel non-IP protocols. See Dynamic PAT, interface PAT, and Static PAT. The FWSM feature that gathers and reports a wide variety of feature statistics, such as connections/second, xlates/second, etc. perfect forward secrecy. PFS enhances security by using different security key for the IPSec Phase 1 and Phase 2 SAs. Without PFS, the same security key is used to establish SAs in both phases. PFS ensures that a given IPSec SA key was not derived from any other secret (like some other keys). In other words, if someone were to break a key, PFS ensures that the attacker would not be able to derive any other key. If PFS were not enabled, someone could hypothetically break the IKE SA secret key, copy all the IPSec protected data, and then use knowledge of the IKE SA secret to compromise the IPSec SA setup by this IKE SA. With PFS, breaking IKE would not give an attacker immediate access to IPSec. The attacker would have to break each IPSec SA individually. See IPSec Phase 1. See IPSec Phase 2. OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM GL-13