Activating Ipsec To A Remote Peer - Motorola WS5100 Series Migration Giude

11-10 WS5100 Series Switch Migration Guide
You can create Cypto Map Set if:
• Connection is required for multiple remote peers OR
• Different types of protection is required to the same peer
A crypto map entry has sequence number associated with it.
Follow the CLI commands mentioned below to create a Crypto Map:
1. Create a crypto map with sequence number10 for remote peer 10.1.1.103 using IKE.
WS5100(config)# crypto map Test1 10 ipsec-isakmp
2. Configure the remote peer address.
WS5100(config-crypto-map)# set peer 10.1.1.103
3. Specify the Crypto ACL to use.
WS5100(config-crypto-map)# match address 101
4. Define the transform set for the data traffic.
WS5100(config-crypto-map)# set transform-set transform1
To create multiple crypto maps, follow the CLI commands mentioned below:
1. Create another crypto map with sequence number20 for remote peer 10.1.1.103 using IKE.
WS5100(config)# crypto map Test2 10 isakmp
2. Configure the remote peer address.
WS5100(config-crypto-map)# set peer 10.1.1.103
3. Specify the Crypto ACL to use.
WS5100(config-crypto-map)# match address 101
4. Define the transform set for the data traffic.
WS5100(config-crypto-map)# set transform-set transform2

11.3.6 Activating IPSec to a Remote Peer

Crypto map set must applied to an VLAN interface, so that IKE and IPSec SA can be applied on traffic that
matches the Crypto ACL.
If no crypto map set is applied to an interface, then the interface allows both incoming and outgoing traffic
by default. If a crypto map gets applied and a traffic does not match the ACL, then the traffic is passed in
plaintext packet.
To apply the crypto map to an interface, follow the CLI commands mentioned below:
1. Create an interface.
WS5100(config)# interface vlan1
2. Assign the crypto map to the interface.
WS5100(config-if)# crypto map Test1
NOTE: For site-site VPN, the interface on which crypto map is applied should represent
the WAN subnet. For remote VPN, the interface should represent the local subnet.