Table of Contents
Advertisement
Configuring IPsec
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m .
Crypto Map Configuration Guidelines
When configuring crypto map entries, follow these guidelines:
•
•
•
If the peer IP address specified in the crypto map entry is a VRRP IP address on a remote MDS switch,
Note
ensure that the IP address is created using the secondary option (see the
Addition" section on page
To create mandatory crypto map entries, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto map
SampleMap 31
ips-hac1(config-crypto-map-ip)#
switch(config)# no crypto map
ipsec SampleMap 3
switch(config)# no crypto map
ipsec SampleMap
Step 3
switch(config-crypto-map-ip)# match
address SampleAcl
switch(config-crypto-map-ip)# no match
address SampleAcl
Step 4
switch(config-crypto-map-ip)# set peer
10.1.1.1
switch(config-crypto-map-ip)# no set
peer 10.1.1.1
Step 5
switch(config-crypto-map-ip)# set
transform-set SampleTransform1
SampleTransmfor2
switch(config-(crypto-map-ip))# no set
transform-set
SA Lifetime Negotiation
You can override the global lifetime values (size and time) by configuring a SA-specific lifetime value.
To specify SA lifetime negotiation values, you can optionally configure the lifetime value for a specified
crypto map. If you do, this value overrides the globally set values. If you do not specify the crypto map
specific lifetime, the global value (or global default) is used.
Cisco MDS 9000 Family Configuration Guide
30-18
The sequence number for each crypto map decides the order in which the policies are applied. A
lower sequence number is assigned a higher priority.
Only one ACL is allowed for each crypto map entry (the ACL itself can have multiple permit or deny
entries).
When the tunnel endpoint is the same as the destination address, you can used the auto-peer option
to dynamically configure the peer.
36-18).
Purpose
Enters configuration mode.
Place you in the crypto map configuration mode for
domain ipsec
the entry named SampleMap with 31 as its sequence
number.
Deletes the specified crypto map entry.
domain
Deletes the entire crypto map set called SampleMap.
domain
Names a ACL to determine which traffic should be
protected and not protected by IPsec in the context of
this crypto map entry.
Deletes the matched address.
Configures a specific peer IP address.
Deletes the configured peer.
Specifies which transform sets are allowed for the
specified crypto map entry or entries. List multiple
transform sets in order of priority (highest priority
first).
Deletes the association of all the transform sets
(regardless of you specifying a transform set name).
Chapter 30
Configuring IPsec Network Security
"Virtual Router IP Address
OL-6973-03, Cisco MDS SAN-OS Release 2.x
Advertisement
Table of Contents
