How To Implement Ipsec Network Security For Locally Sourced And Destined Traffic - Cisco CRS-1 - Carrier Routing System Router Configuration Manual

Implementing IPSec Network Security on Cisco IOS XR Software
Command or Action
Step 17
show crypto ipsec sa [sa-id | peer ip-address |
profile profile-name | detail | fvrf fvrf-name
| ivrf ivrf-name | location location]
Example:
RP/0/RP0/CPU0:router# show crypto ipsec sa peer
172.19.72.120
Step 18
show crypto ipsec summary
Example:
RP/0/RP0/CPU0:router# show crypto ipsec summary
How to Implement IPSec Network Security for Locally Sourced
and Destined Traffic
Locally sourced and terminated traffic are evaluated against IPSec profiles that are attached to
tunnel-ipsec interfaces or crypto transport.
Note •
•
This section contains the following procedures:
•
•
•
About Use of the any Keyword in Crypto Access Lists
When you create crypto access lists, using the any keyword could cause problems. We discourage the
use of the any keyword to specify source or destination addresses. The any keyword is relevant only to
locally sourced or terminated traffic.
No concept of default access lists exists for IPSec.
The permit any any statement is strongly discouraged, because it causes all outbound traffic to be
protected (and all protected traffic to be sent to the peer specified in the corresponding crypto profile
entry) and requires protection for all inbound traffic. Then, all inbound packets that lack IPSec protection
are silently dropped, including packets for routing protocols, NTP, echo, and echo response.
OL-20382-01
Multiple profiles can be attached to a tunnel-ipsec interface or crypto transport.
For locally sourced traffic or terminated traffic, we discourage the use of the any keyword to specify
source or destination addresses in the crypto profiles, which are attached to the tunnel-ipsec
interface or transport. This recommendation is only for locally sourced traffic for VPN transit traffic.
You can encrypt all the traffic going through the interface. Therefore, ACLs in profiles, which are
attached to service-ipsec interfaces, can use the any keyword).
About Use of the any Keyword in Crypto Access Lists, page 97
Applying Crypto Profiles to tunnel-ipsec Interfaces, page 98
Applying Crypto Profiles to Crypto Transport, page 99
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router

How to Implement IPSec Network Security for Locally Sourced and Destined Traffic

Purpose
(Optional) Displays SA information based on the
rack/slot/instance location.
• Use the optional detail keyword to display additional
dynamic SA information. The detail keyword is used
only for software-based SAs. SAs that are configured
under the tunnel-ipsec interface or crypto transport.
(Optional) Displays IPSec summary information.
SC-97