D-Link DI-1750 Reference Manual page 363

♦ Defining Transform Sets
♦ Creating Crypto Map Entries
♦ Applying Crypto Map Sets to Interfaces
8.4.3 Ensuring That Access Lists Are Compatible With IPSec
IKE uses UDP port 500. The IPSec ESP and AH protocols use protocol numbers 50 and 51. Ensure
that your access lists are configured so that protocol 50, 51, and UDP port 500 traffic is not blocked at
interfaces used by IPSec.
8.4.4 Creat Crypto Access Lists
Crypto access lists are used to define which IP traffic will be protected by crypto and which traffic will
not be protected by crypto. (These access lists are not the same as regular access lists, which
determine what traffic to forward or block at an interface.)
Crypto access lists associated with IPSec crypto map entries have four primary functions:
(1) Select outbound traffic to be protected by IPSec (permit = protect).
(2) Indicate the data flow to be protected by the new security associations (specified by a single
permit entry) when initiating negotiations for IPSec security associations.
(3) Process inbound traffic in order to filter out and discard traffic that should have been protected
by IPSec.
(4) Determine whether or not to accept requests for IPSec security associations on behalf of the
requested data flows when processing IKE negotiation from the IPSec peer.
If you want certain traffic to receive one combination of IPSec protection (for example, authentication
only) and other traffic to receive a different combination of IPSec protection (for example, both
authentication and encryption), you need to create two different crypto access lists to define the two
different types of traffic. These different access lists are then used in different crypto map entries which
specify different IPSec policies.
Later, you will associate the crypto access lists to particular interfaces when you configure and apply
crypto map sets to the interfaces. To create crypto access lists, use the following command in global
configuration mode:
ip access-list extended name
permit
source-mask
destination-mask
[DEFAULT@Router /config/]#ip
Key Word:
U(undo) D(default)
(00)access-list
(01)as-path
......
Please Input the code of command to be excute(0-20): 0
Key Word:
Q(quit)
(00)extended
(01)standard
Please Input the code of command to be excute(0-1): 0
Key Word:
Q(quit)
(00)WORD
Please Input the code of command to be excute(0-0): 0
Please input a string:dlink （Input Access-list name）
Command
Specifies which IP packets will be encrypting protected.
Specifies accession rular
protocol source
destination
Q(quit)
Named access-list
BGP as-path access list definition
Extended Access List
Standard Access List
Extended Access-list name
Model Name
Purpose
- 361 -