Cisco FirePOWER ASA 5500 series Configuration Manual page 519

Chapter 27 Configuring IPSec and ISAKMP
Figure 27-2
Crypto Map 1
Deny
A.3 B
Crypto Map 2
Security Appliance A evaluates a packet originating from Host A.3 until it matches a permit ACE and
attempts to assign the IPSec security associated with the crypto map. Whenever the packet matches a
deny ACE, the security appliance ignores the remaining ACEs in the crypto map and resumes evaluation
against the next crypto map, as determined by the sequence number assigned to it. So in the example, if
Security Appliance A receives a packet from Host A.3, it matches the packet to a deny ACE in the first
crypto map and resumes evaluation of the packet against the next crypto map. When it matches the
packet to the permit ACE in that crypto map, it applies the associated IPSec security (strong encryption
and frequent rekeying).
OL-10088-01
Cascading ACLs in a Crypto Map Set
Deny
A.3 C
Permit
A B
Apply IPSec assigned to Crypto Map 1
Permit
A.3 B
Permit
A.3 C
Apply IPSec
assigned to
Crypto Map 2
Permit
A C
Route as clear text
Cisco Security Appliance Command Line Configuration Guide
Configuring IPSec
27-17