access list for traffic crossing and IPSEC

Similar Questions

• Question of access list for Cisco 1710 performing the 3DES VPN tunnel

  I have a question about the use of access lists in the configuration of a router Cisco 1710 that uses access lists to control traffic through the VPN tunnel.

  For example the following lines in a configuration on the remote router. My question is whether or not the traffic that matches the definition of list access-130 (something other than 192.168.100.0/24), cross the VPN tunnel or go directly to the Ethernet0 interface.

  My understanding is that traffic that matches the access list 120 would be encrypted and sent through the IPSec tunnel. If there was "ban" set out in the statements of 120 access-list, the traffic for those would be sent through the IPSec tunnel but not encrypted (if possible). And finally, given that the definition of crypto card reference only "adapt to 120", any traffic that matches 130 access list would be sent Ethernet0 but not associated with the card encryption and thus not sent through the IPSec tunnel. "

  Any input or assistance would be greatly appreciated.

  Map Test 11 ipsec-isakmp crypto

  ..

  match address 120

  Interface Ethernet0

  ..

  card crypto Test

  IP nat inside source overload map route sheep interface Ethernet0

  access-list 120 allow ip 192.168.100.0 0.0.0.255 10.10.0.0 0.0.255.255

  access-list 130 refuse ip 192.168.100.0 0.0.0.255 10.10.0.0 0.0.255.255

  access-list 130 allow ip 192.168.100.0 0.0.0.255 any

  sheep allowed 10 route map

  corresponds to the IP 130

  He would go through the interface e0 to the Internet in clear text without going above the tunnel

  Jean Marc

• Different 'outside_cryptomap access-list"for each VPN?

  Hello

  Just for my understanding.

  I have a VPN connected to my Cisco ASA 5520 when I tried to add an another VPN, the I must create a 2nd cryptomap, can I not create a group so there is only one card encryption?

  Currently I have:

  access-list 1 permit line outside_cryptomap_1 extended ip 0.0.0.0 0.0.0.0 172.19.15.0 255.255.255.0

  I just added outside_cryptomap_2 line access-list 1 permit extended ip 0.0.0.0 0.0.0.0 172.19.2.0 255.255.255.0

  But I was wondering if I could use something like:

  access-list 1 permit line outside_mycryptomap extended ip 0.0.0.0 0.0.0.0 VPN_Remote_Networks object-group

  When I do this, but I guess that this will cause a problem with the address in hand?

  You must use different access-list in cryptomap for each VPN.

• A global Access List for possible VPN3005?

  Hello

  I want to what the VPN users and LAN-to-LAN-profiles are allowed to.

  for example. to block the RPC (tcp135) ports for all traffic from any profile

  Is this possible?

  Kind regards

  Chris

  You can create this filter in one place and then just apply it to each group of users and each configuration of tunnel L2L.

  Go to Config - Mgmt policy - traffic Mgmt - rules, add an inbound rule, drop, Protocol = TCP, Source and Dest everything (leave them as what), range from 135 to 135 TCP DEst ports.

  Go to config - Mgmt - traffic Mgmt - political filters, add a filter whose default action is to transfer, and then add the rule that you just created to this filter.

  Now, you can apply to all users by going under the Group and on the tab general and addition of th efilter in there. You can also go into the tunnel L2L config and add the filter to the tunnel directly.

  Note that you want to test this first, I didn't do all the tests and perhaps the source/dest or inbound/outbound in the wrong way or something like that.

• Access list for a single host 6248

  Hello

  I'm trying to setp an ACL on a powerconnect 6248 switch that allows traffic from certain hosts on a VIRTUAL LAN to another VIRTUAL local network.  I tried the setting up of an ACL to do this, but it does not work.  What would be the correct syntac for an ACL allow traffic to a certain vlan only to certain hosts?

  Please advise, ideas or recommendations would be greatly appreciated.

  Thank you

  Marlon

  
  

• Table or list for images icons and their explanation?

  Hello

  In our user manuals, we have descriptions of the icons next to the image of the respective icon. So far I've always used a table, but do not allow the elements in array is predefined in DITA for a narrow first column and the second column wider. I appreciate any suggestions how I can do this in structured FM.

  Yes... Tables DITA can specify the width of the columns. This is done with the table/tgroup/colspec/@colwidth attribute. FM, you should be able to simply drag or set the widths of column by means 'normal', and it will remain. Note that by default, you will use proportional widths (as specified in the rules of r/w file), the table will always fill the text column.

  Note that if you use "binary" DITA files (which means, you return in XML format, but keep as structured FM files), you will probably lose some benefits from the use of DITA. This isn't necessarily a bad thing if what you need, but just be aware what's you use DITA structured file FM, which is very different with XML DITA.

  See you soon,.

  .. .Scott

• Cisco 837 and access list

  Hi all

  Sorry if my question sounds stupid, but I had a lot of problems with the syntax of the access list, especially to remove a line in an access list, for example:

  Here is my list of access

  access-list 120 allow ip 192.168.6.0 0.0.0.255 172.16.0.0 0.0.255.255

  access-list 120 allow ip 192.168.6.0 0.0.0.255 172.20.0.0 0.0.255.255

  access-list 120 allow ip 192.168.6.0 0.0.0.255 172.17.0.0 0.0.255.255

  If I want to delete only this line

  access-list 120 allow ip 192.168.6.0 0.0.0.255 172.16.0.0 0.0.255.255

  I do not know how, I if do:

  no access-list 120 allow ip 192.168.6.0 0.0.0.255 172.16.0.0 0.0.255.255

  all the access-list 120 is removed!

  Help, please!

  Olivier

  Hi, this is the usual behavior, if you delete the access list of the entire statement with sequence number is deleted.

  You can create a named extended access-list and have the sequence number for each statements.

  !

  Standard IP access list note

  permit 172.10.0.0 0.0.255.255

  10.1.1.0 permit 0.0.0.255

  permit 192.168.1.0 0.0.0.255

  deny all

  !

  and if you want to delete something in between, or any particular line, you can run the command like this that will remove this line instead of the entire ACL itself...

  Standard note of access-list (config) #ip

  (config-std-nacl) #no 3

  This configuration lines will remove the third line only (which is to allow the 192.168.1.0 0.0.0.255, leaving the other statements)

  regds

• Levels of security and access lists

  I have DMZ1 (security50) that needs to access DMZ2 (security20). However, for access to the work I need to modify the access list that controls access of DMZ1 inside (Security 100). My understanding is that you only need statements of access list for the access of low to high not top-to-bottom.

  I simply get it wrong?

  Andrew,

  In general what you say is true. That is how the PIX is designed. But, once you apply the acl on the security interface higher than its interior or the demilitarized zone, default behavior is no longer there. In this case, you must allow exclusively the superior traffic lower. So, it's flexibility as security engineer to check our our strictly secure LAN traffic. Although we know that the inside is always fixed, but an acl can be applied to control which traffic is allowed outside or dmz. Your case is a classic example of why you need a lower LCD of higher security interface.

  I hope this helps! Thank you

  Renault

• card crypto access lists / problem if more than one entry?

  Access list for IPSec enabled traffic.

  I've been recently setting up a VPN between two sites and I came across the following problem:

  I wanted to install a VPN that only 2 posts from site A to site B, a class C network

  So I created a list of access as follows:

  access-list 101 permit IP 192.168.0.1 host 192.168.1.0 0.0.0.255

  access-list 101 permit IP 192.168.0.2 host 192.168.1.0 0.0.0.255

  When I applied the access list above to map (match address 101) encryption, I quickly realized that only the first host (192.168.0.1) was successfully encrypted beeing while the other could not. I've been geeting on ipsec debugging errors saying that traffic to 192.168.0.2 denyed by the access list.

  When I changed the access list above with the following

  access-list 101 permit IP 192.168.0.1 0.0.0.255 192.168.1.0 0.0.0.255

  two items of work could successfully encrypted through IPSec tunnel.

  To look further into it, I realized that only the first entry of the IPsec access list has been really tested for the corresponding traffic!

  Is this a normal behavior or a known Bug? No work around for this problem?

  Kind regards.

  If you have ipsec-manual crypto map in crypto ACL, you can specify that an ACE. Check 12.2 docs:

  Access lists for labelled as ipsec-manual crypto map entries are limited to a single permit entry and the following entries are ignored. In other words, the security associations established by this particular entry card crypto are only for a single data stream. To be able to support several manually created security for different types of traffic associations, define multiple crypto access lists and then apply each a separate entrance card crypto ipsec-manual. Each access list should include a statement to define which traffic to protect.

• access-list with PAT

  Hi guys,.

  I would like to know if the accesslist with PAT, you can refuse statements. IE reject the order under the access list for the traffic that you do not want to be PATed.

  example:

  access list acl-pat deny ip 10.0.0.1 0.0.0.0 all

  permit access-list acl - pat ip 10.0.0.0 0.0.0.255 any

  If I won't 10.0.0.1 PATed.

  Hello

  It's perfectly legal and quite a common practice.

  Hope that help - rate pls post if it does.

  Paresh

• A possible bug related to the Cisco ASA "show access-list"?

  We had a strange problem in our configuration of ASA.

  In the "show running-config:

  Inside_access_in access-list CM000067 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:http_access

  Inside_access_in access-list CM000458 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:https_access

  Note to inside_access_in to access test 11111111111111111111111111 EXP:1/16/2014 OWN list: IT_Security BZU:Network_Security

  access-list extended inside_access_in permit tcp host 1.1.1.1 host 192.168.20.86 eq 81 Journal

  access-list inside_access_in note CM000260 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:netbios - dgm

  access-list inside_access_in note CM006598 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:netbios - ns

  access-list inside_access_in note CM000220 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:netbios - ssn

  access-list inside_access_in note CM000223 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:tcp / 445

  inside_access_in list extended access permitted tcp 172.31.254.0 255.255.255.0 any eq www log

  inside_access_in allowed extended access list tcp 172.31.254.0 255.255.255.0 any https eq connect

  inside_access_in list extended access permit udp 172.31.254.0 255.255.255.0 any eq netbios-dgm log

  inside_access_in list extended access permit udp 172.31.254.0 255.255.255.0 connect any eq netbios-ns

  inside_access_in list extended access permitted tcp 172.31.254.0 255.255.255.0 any eq netbios-ssn log

  inside_access_in list extended access permitted tcp 172.31.254.0 connect any EQ 445 255.255.255.0

  Inside_access_in access-list CM000280 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:domain

  inside_access_in list extended access permitted tcp object 172.31.254.2 any newspaper domain eq

  inside_access_in list extended access permitted udp object 172.31.254.2 any newspaper domain eq

  Inside_access_in access-list CM000220 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:catch_all

  inside_access_in list extended access permitted ip object 172.31.254.2 any newspaper

  Inside_access_in access-list CM0000086 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:SSH_internal

  inside_access_in list extended access permitted tcp 172.31.254.0 255.255.255.0 interface inside the eq ssh log

  Inside_access_in access-list CM0000011 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:PortRange

  inside_access_in list extended access allow object TCPPortRange 172.31.254.0 255.255.255.0 host log 192.168.20.91

  Inside_access_in access-list CM0000012 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:FTP

  access-list extended inside_access_in permitted tcp object inside_range 1024 45000 192.168.20.91 host range eq ftp log

  Inside_access_in access-list CM0000088 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:PortRange

  inside_access_in access list extended ip 192.168.20.0 255.255.255.0 allow no matter what paper

  Inside_access_in access-list CM0000014 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:DropIP

  inside_access_in list extended access permitted ip object windowsusageVM any newspaper

  inside_access_in list of allowed ip extended access any object testCSM

  inside_access_in access list extended ip 172.31.254.0 255.255.255.0 allow no matter what paper

  Inside_access_in access-list CM0000065 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:IP

  inside_access_in list extended access permit ip host 172.31.254.2 any log

  Inside_access_in access-list CM0000658 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security

  inside_access_in list extended access permit tcp host 192.168.20.95 any log eq www

  In the "show access-list":

  access-list inside_access_in line 1 comment CM000067 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:http_access

  access-list inside_access_in line 2 Note CM000458 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:https_access

  Line note 3 access-list inside_access_in test 11111111111111111111111111 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security

  4 extended access-list inside_access_in line allowed tcp host 1.1.1.1 host 192.168.20.86 eq newsletter interval 300 (hitcnt = 0) 81 0x0a 3bacc1

  line access list 5 Note CM000260 EXP:1/16/2014 OWN inside_access_in: IT_Security BZU:Network_Security JST:netbios - dgm

  line access list 6 Note CM006598 EXP:1/16/2014 OWN inside_access_in: IT_Security BZU:Network_Security JST:netbios - ns

  line access list 7 Note CM000220 EXP:1/16/2014 OWN inside_access_in: IT_Security BZU:Network_Security JST:netbios - ssn

  line access list 8 Note CM000223 EXP:1/16/2014 OWN inside_access_in: IT_Security BZU:Network_Security JST:tcp / 445

  allowed to Access-list inside_access_in line 9 extended tcp 172.31.254.0 255.255.255.0 any interval information eq www journal 300 (hitcnt = 0) 0 x 06 85254 has

  allowed to Access-list inside_access_in 10 line extended tcp 172.31.254.0 255.255.255.0 any https eq log of information interval 300 (hitcnt = 0) 0 x7e7ca5a7

  allowed for line access list 11 extended udp 172.31.254.0 inside_access_in 255.255.255.0 any netbios-dgm eq log of information interval 300 (hitcn t = 0) 0x02a111af

  allowed to Access-list inside_access_in line 12 extended udp 172.31.254.0 255.255.255.0 any netbios-ns eq log of information interval 300 (hitcnt = 0) 0 x 19244261

  allowed for line access list 13 extended tcp 172.31.254.0 inside_access_in 255.255.255.0 any netbios-ssn eq log of information interval 300 (hitcn t = 0) 0x0dbff051

  allowed to Access-list inside_access_in line 14 extended tcp 172.31.254.0 255.255.255.0 no matter what eq 445 300 (hitcnt = 0) registration information interval 0 x 7 b798b0e

  access-list inside_access_in 15 Note CM000280 EXP:1/16/2014 OWN line: IT_Security BZU:Network_Security JST:domain

  allowed to Access-list inside_access_in line 16 extended tcp object 172.31.254.2 any interval information journal field eq 300 (hitcnt = 0) 0x6c416 81 b

  allowed to Access-list inside_access_in line 16 extended host tcp 172.31.254.2 any interval information journal field eq 300 (hitcnt = 0) 0x6c416 81 b

  allowed to Access-list inside_access_in line 17 extended udp object 172.31.254.2 any interval information journal field eq 300 (hitcnt = 0) 227 0xc53bf

  allowed to Access-list inside_access_in line 17 extended udp host 172.31.254.2 all interval information journal field eq 300 (hitcnt = 0) 227 0xc53bf

  access-list inside_access_in 18 Note CM000220 EXP:1/16/2014 OWN line: IT_Security BZU:Network_Security JST:catch_all

  allowed to Access-list inside_access_in line 19 scope ip object 172.31.254.2 no matter what information recording interval 300 (hitcnt = 0) 0xd063707c

  allowed to Access-list inside_access_in line 19 scope ip host 172.31.254.2 any which information recording interval 300 (hitcnt = 0) 0xd063707c

  access-list inside_access_in line 20 note CM0000086 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:SSH_internal

  permit for line access list extended 21 tcp 172.31.254.0 inside_access_in 255.255.255.0 interface inside the eq ssh information recording interval 300 (hitcnt = 0) 0x4951b794

  access-list inside_access_in line 22 NOTE CM0000011 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:PortRange

  permit for access list 23 inside_access_in line scope object TCPPortRange 172.31.254.0 255.255.255.0 192.168.20.91 host registration information interval 300 (hitcnt = 0) 0x441e6d68

  allowed for line access list 23 extended tcp 172.31.254.0 inside_access_in 255.255.255.0 192.168.20.91 host range ftp smtp log information interval 300 (hitcnt = 0) 0x441e6d68

  access-list inside_access_in line 24 Note CM0000012 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:FTP

  25 extended access-list inside_access_in line allowed tcp object inside_range Beach 1024 45000 host 192.168.20.91 eq ftp interval 300 0xe848acd5 newsletter

  allowed for access list 25 extended range tcp 12.89.235.2 inside_access_in line 12.89.235.5 range 1024 45000 host 192.168.20.91 eq ftp interval 300 (hitcnt = 0) newsletter 0xe848acd5

  permit for access list 26 inside_access_in line scope ip 192.168.20.0 255.255.255.0 no interval 300 (hitcnt = 0) newsletter 0xb6c1be37

  access-list inside_access_in line 27 Note CM0000014 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:DropIP

  allowed to Access-list inside_access_in line 28 scope ip object windowsusageVM no matter what information recording interval 300 (hitcnt = 0) 0 x 22170368

  allowed to Access-list inside_access_in line 28 scope ip host 172.31.254.250 any which information recording interval 300 (hitcnt = 0) 0 x 22170368

  allowed to Access-list inside_access_in line 29 scope ip testCSM any object (hitcnt = 0) 0xa3fcb334

  allowed to Access-list inside_access_in line 29 scope ip any host 255.255.255.255 (hitcnt = 0) 0xa3fcb334

  permit for access list 30 inside_access_in line scope ip 172.31.254.0 255.255.255.0 no interval 300 (hitcnt = 0) newsletter 0xe361b6ed

  access-list inside_access_in line 31 Note CM0000065 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security JST:IP

  allowed to Access-list inside_access_in line 32 scope ip host 172.31.254.2 any which information recording interval 300 (hitcnt = 0) 0xed7670e1

  access-list inside_access_in line 33 note CM0000658 EXP:1/16/2014 OWN: IT_Security BZU:Network_Security

  allowed to Access-list inside_access_in line 34 extended host tcp 192.168.20.95 any interval information eq www 300 newspapers (hitcnt = 0) 0x8d07d70b

  There is a comment in the running configuration: (line 26)

  Inside_access_in access-list CM0000088 EXP:1/16/2014 OWN Note: IT_Security BZU:Network_Security JST:PortRange

  This comment is missing in 'display the access-list '. In the access list, for all lines after this comment, the line number is more correct. This poses problems when trying to use the line number to insert a new rule.

  Everyone knows about this problem before? Is this a known issue? I am happy to provide more information if necessary.

  Thanks in advance.

  See the version:

  Cisco Adaptive Security Appliance Software Version 4,0000 1

  Version 7.1 Device Manager (3)

  Updated Friday, June 14, 12 and 11:20 by manufacturers

  System image file is "disk0: / asa844-1 - k8.bin.

  The configuration file to the startup was "startup-config '.

  fmciscoasa up to 1 hour 56 minutes

  Material: ASA5505, 512 MB RAM, 500 MHz Geode Processor

  Internal ATA Compact Flash, 128 MB

  BIOS Flash M50FW016 @ 0xfff00000, 2048KB

  Hardware encryption device: Cisco ASA-5505 Accelerator Board (revision 0 x 0)

  Start firmware: CN1000-MC-BOOT - 2.00

  SSL/IKE firmware: CNLite-MC-Smls-PLUS - 2.03

  Microcode IPSec:-CNlite-MC-IPSECm-HAND - 2.06

  Number of Accelerators: 1

  Could be linked to the following bug:

  CSCtq12090: ACL note line is missing when the object range is set to ACL

  The 8.4 fixed (6), so update to a newer version and observe again.

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• ERROR: access-list has an icmp type selector

  Hi all

  Im trying to apply the access list to crypto card. and when I apply it its gives me error

  ERROR: access-list has an icmp type selector

  no idea please. Thank you all

  The crypto-acl must be of type IP Allow. You should not specify protocols, such as the Protocol ICMP, tcp, etc..

  If your proxy-ACLs should sth looks like this:

  PROXY_ACL from IP x.x.x.x 255.255.255.9 access list permit y.y.y.y 255.255.255.0

  but it's not:

  access-list host x.x.x.x y.y.y.y eq icmp echo host allowed PROXY_ACL

• Access-list group policy and IPSec tunnel.

  I have an IPSec Site to Site VPN tunnel that ends on the external interface of the firewall. My ftp server is located in a demilitarized zone. The DMZ has an access list applied to the interface. When I created the Group of the tunnel for the Site to Site, I create a group of tunnel with group policy and manage the policy with filters. The filter looks like an access list. Are the filter and the ACL interface work together? The one replace the other? How they work together.

  Once traffic ipsec, acl interface is not used until you have enabled "sysopt conn allowed-/ ipsec vpn. When you add a vpn-filter, it is what will filter the ipsec traffic.

• How PIX cross access lists?

  I'm new with PIX.

  I would like to know how this fw through access lists. I mean, it's in what order it checks the rules. I guess it can be quite an important issue if you want to keep performance with more than 400 rules and a flow of traffic.

  I thank the of for any comment.

  Hello

  the pix treats the ACL from top to bottom. Put the rules used most frequently at the top. After a match, the pix stop processing the ACL.

  Kind regards

  Tom

• IOS VPN on 7200 12.3.1 and access-list problem

  I'm in IOS 12.3 (1) a 7200 and have configured it for VPN access. I use the Cisco VPN client. Wonder if someone has encountered the following problem, and if there is a fix.

  The external interface has the access-list standard applied that blocks incoming traffic. One of the rules is to block the IPs private, not routable, such as the 10.0.0.0 concern, for example.

  When I set my VPN connection, none of my packets get routed and I noticed that outside access list interface blocks the traffic. When I connect to the router through VPN, the router attributes to the client an IP address from a pool of the VPN as 10.1.1.0/24. But normal outside the access list denies this traffic as it should. But as soon as I have established a VPN connect, it seems that my encrypted VPN traffic must ignore the external interface access list.

  If I change my external access list to allow traffic from source address 10.1.1.0/24 my VPN traffic goes through correctly, but this goes against the application to have an outdoor access list that denies such traffic and have a VPN.

  Anyone else seen this problem or can recommend a software patch or version of IOS which works correctly?

  Thank you

  R

  That's how IOS has always worked, no way around it.

  The reasoning is to do with the internal routing on the router. Basically an encrypted packet inherits from the interface and initially past control of ACL as an encrypted packet. Then expelled the crypto engine and decrypted, so we now have this sitting pouch in the cryptographic engine part of the router. What do we with her now, keeping in mind users may want political route she is also, might want to exercise, qos, etc. etc. For this reason, the package is basically delivered on the external interface and running through everything, once again, this time as a decrypted packet. If the package hits the ACL twice, once encrypted and clear once.

  Your external ACL shall include the non encrypted and encrypted form of the package.

  Now, if you're afraid that people can then simply spoof packets to come from 10.1.1.0 and they will be allowed through your router, bzzzt, wrong. The first thing that the router checks when it receives a packet on an interface with a card encryption applied is that if the package needs to be encrypted, it is from his crypto ACL and its IP pools. If he receives a decrypted packet when it knows that it must have been encrypted, it will drop the package immediately and a flag a syslog something as "received the decrypted packet when it should have been."

  You can check on the old bug on this here:

  http://www.Cisco.com/cgi-bin/support/Bugtool/onebug.pl?BugID=CSCdz54626&submit=search

  and take note of the section of the security implications, you may need to slightly modify your configuration.