Cisco MDS 9000 Series Configuration Manual page 207

Configuring IPSec Network Security
Example
Note
The show ip access-list command does not display the crypto map entries. Use the show crypto
map command to display the associated entries.
About Transform Sets in IPsec
A transform set represents a certain combination of security protocols and algorithms. During the IPsec security
association negotiation, the peers agree to use a particular transform set for protecting a particular data flow.
You can specify multiple transform sets, and then specify one or more of these transform sets in a crypto map
entry. The transform set defined in the crypto map entry is used in the IPsec security association negotiation
to protect the data flows specified by that crypto map entry's access list.
During IPsec security association negotiations with IKE, the peers search for a transform set that is the same
at both peers. When such a transform set is found, it is selected and applied to the protected traffic as part of
both peers' IPsec security associations.
Tip If you change a transform set definition, the change is only applied to crypto map entries that reference the
transform set. The change is not applied to existing security associations, but used in subsequent negotiations
to establish new security associations. If you want the new settings to take effect sooner, you can clear all or
part of the security association database.
Note
When you enable IPsec, the Cisco NX-OS software automatically creates a default transform set
(ipsec_default_tranform_set) using AES-128 encryption and SHA-1 authentication algorithms.
The following table provides a list of allowed transform combinations for IPsec.
Table 14: IPsec Transform Configuration Parameters
Parameter
encryption algorithm
Accepted Values
56-bit DES-CBC
168-bit DES
128-bit AES-CBC
3
128-bit AES-CTR
256-bit AES-CBC
256-bit AES-CTR 1
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
About Transform Sets in IPsec
Keyword
esp-des
esp-3des
esp-aes 128
esp-aes 128 ctr
esp-aes 256
esp-aes 256 ctr
189