Cisco MDS 9000 Series Configuration Manual page 203

Configuring IPSec Network Security
• Select outbound traffic to be protected by IPsec (permit = protect).
• Indicate the data flow to be protected by the new SAs (specified by a single permit entry) when initiating
• Process inbound traffic to filter out and discard traffic that should have been protected by IPsec.
• Determine whether or not to accept requests for IPsec SAs on behalf of the requested data flows when
Tip
If you want some traffic to receive one type of IPsec protection (for example, encryption only) and other
traffic to receive a different type of IPsec protection (for example, both authentication and encryption), create
two IPv4-ACLs. Use both IPv4-ACLs in different crypto maps to specify different IPsec policies.
Note IPsec does not support IPv6-ACLs.
Crypto IPv4-ACL Guidelines
Follow these guidelines when configuring IPv4-ACLs for the IPsec feature:
• The Cisco NX-OS software only allows name-based IPv4-ACLs.
• When an IPv4-ACL is applied to a crypto map, the following options apply:
Note IKE traffic (UDP port 500) is implicitly transmitted in clear text.
• The IPsec feature only considers the source and destination IPv4 addresses and subnet masks, protocol,
Note The IPsec feature does not support port number ranges and ignores higher port number field, if specified.
• The permit option causes all IP traffic that matches the specified conditions to be protected by crypto,
• The deny option prevents traffic from being protected by crypto. The first deny statement causes the
• The crypto IPv4-ACL you define is applied to an interface after you define the corresponding crypto
• Different IPv4-ACLs must be used in different entries of the same crypto map set.
negotiations for IPsec SAs.
processing IKE negotiation from the IPsec peer.
• Permit—Applies the IPsec feature to the traffic.
• Deny—Allows clear text (default).
and single port number. There is no support for IPv6 in IPsec.
using the policy described by the corresponding crypto map entry.
traffic to be in clear text.
map entry and apply the crypto map set to the interface.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Crypto IPv4-ACL Guidelines
185