Cisco MDS 9000 Series Configuration Manual page 206

The any Keyword in Crypto IPv4-ACLs
on page
matching the crypto IPv4-ACL criteria to be silently dropped instead of being forwarded with IPsec security.
In case 4, an SA cannot be established because SAs are always requested according to the crypto IPv4-ACLs
at the initiating packet's end. In case 4, router N requests that all traffic between subnet X and subnet Y be
protected, but this is a superset of the specific flows permitted by the crypto IPv4-ACL at switch M so the
request is not permitted. Case 3 works because switch M's request is a subset of the specific flows permitted
by the crypto IPv4-ACL at router N.
Because of the complexities introduced when crypto IPv4-ACLs are not configured as mirror images at peer
IPsec devices, we strongly encourage you to use mirror image crypto IPv4-ACLs.
The any Keyword in Crypto IPv4-ACLs
Tip We recommend that you configure mirror image crypto IPv4-ACLs for use by IPsec and that you avoid using
the any option.
The any keyword in a permit statement is discouraged when you have multicast traffic flowing through the
IPsec interface. This configuration can cause multicast traffic to fail.
The permit any statement causes all outbound traffic to be protected (and all protected traffic sent to the
peer specified in the corresponding crypto map entry) and requires protection for all inbound traffic. Then,
all inbound packets that lack IPsec protection are silently dropped, including packets for routing protocols,
NTP, echo, echo response, and so forth.
You need to be sure you define which packets to protect. If you must use any in a permit statement, you must
preface that statement with a series of deny statements to filter out any traffic (that would otherwise fall within
that permit statement) that you do not want to be protected.
Creating Crypto IPv4-ACLs
To create IPv4-ACLs, follow these steps:
Procedure
Step 1 switch# configure terminal
switch(config)#
Enters configuration mode.
Step 2
switch(config)# ip access-list List1 permit ip 10.1.1.100 0.0.0.255 11.1.1.100 0.0.0.255
Permits all IP traffic from and to the specified networks.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
188
187. IPsec SA establishment is critical to IPsec. Without SAs, IPsec does not work, causing any packets
Configuring IPSec Network Security