Cisco MDS 9000 Series Configuration Manual page 204

Crypto IPv4-ACL Guidelines
• Inbound and outbound traffic is evaluated against the same outbound IPv4-ACL. Therefore, the
IPv4-ACL's criteria is applied in the forward direction to traffic exiting your switch, and the reverse
direction to traffic entering your switch.
• Each IPv4-ACL filter assigned to the crypto map entry is equivalent to one security policy entry. The
IPsec feature supports up to 120 security policy entries for each MPS-14/2 module and Cisco MDS 9216i
Switch.
• IPsec protection (see
between switch interface S0 (IPv4 address 10.0.0.1) and switch interface S1 (IPv4 address 20.0.0.2) as
the data exits switch A's S0 interface enroute to switch interface S1. For traffic from 10.0.0.1 to 20.0.0.2,
the IPv4-ACL entry on switch A is evaluated as follows:
• source = IPv4 address 10.0.0.1
• dest = IPv4 address 20.0.0.2
For traffic from 20.0.0.2 to 10.0.0.1, that same IPv4-ACL entry on switch A is evaluated as follows:
• source = IPv4 address 20.0.0.2
• dest = IPv4 address 10.0.0.1
Figure 13: IPsec Processing of Crypto IPv4-ACLs
• If you configure multiple statements for a given crypto IPv4-ACL that is used for IPsec, the first permit
statement that is matched is used to determine the scope of the IPsec SA. Later, if traffic matches a
different permit statement of the crypto IPv4-ACL, a new, separate IPsec SA is negotiated to protect
traffic matching the newly matched IPv4-ACL statement.
• Unprotected inbound traffic that matches a permit entry in the crypto IPv4-ACL for a crypto map entry
flagged as IPsec is dropped, because this traffic was expected to be protected by IPsec.
• You can use the show ip access-lists command to view all IP-ACLs. The IP-ACLs used for traffic
filtering purposes are also used for crypto.
• For IPsec to interoperate effectively with Microsoft iSCSI initiators, specify the TCP protocol and the
local iSCSI TCP port number (default 3260) in the IPv4-ACL. This configuration ensures the speedy
recovery of encrypted iSCSI sessions following disruptions such as Gigabit Ethernet interfaces shutdowns,
VRRP switchovers, and port failures.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
186
Figure 13: IPsec Processing of Crypto IPv4-ACLs, on page
Configuring IPSec Network Security
186) is applied to traffic