Cisco MDS 9000 Series Configuration Manual page 210

Crypto Map Configuration Guidelines
When a packet matches a permit entry in a particular IPv4-ACL, the corresponding crypto map entry is tagged,
and the connections are established.
Crypto Map Configuration Guidelines
When configuring crypto map entries, follow these guidelines:
• The sequence number for each crypto map decides the order in which the policies are applied. A lower
• Only one IPv4-ACL is allowed for each crypto map entry (the IPv4-ACL itself can have multiple permit
• When the tunnel endpoint is the same as the destination address, you can use the auto-peer option to
• For IPsec to interoperate effectively with Microsoft iSCSI initiators, specify the TCP protocol and the
Creating Crypto Map Entries
Note If the peer IP address specified in the crypto map entry is a VRRP IP address on a remote Cisco MDS switch,
ensure that the IP address is created using the secondary option (see the Cisco MDS 9000 Family NX-OS IP
Services Configuration Guide for more information).
To create mandatory crypto map entries, follow these steps:
Procedure
Step 1
switch# configure terminal
switch(config)#
Enters configuration mode.
Step 2 switch(config)# crypto map domain ipsec SampleMap 31
ips-hac1(config-crypto-map-ip)#
Places you in the crypto map configuration mode for the entry named SampleMap with 31 as its sequence
number.
Step 3 switch(config)# no crypto map domain ipsec SampleMap 31
(Optional) Deletes the specified crypto map entry.
Step 4
switch(config)# no crypto map domain ipsec SampleMap
(Optional) Deletes the entire crypto map set called SampleMap.
Step 5 switch(config-crypto-map-ip)# match address SampleAcl
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
192
sequence number is assigned a higher priority.
or deny entries).
dynamically configure the peer.
local iSCSI TCP port number (default 3260) in the IPv4-ACL. This configuration ensures the speedy
recovery of encrypted iSCSI sessions following disruptions such as Gigabit Ethernet interfaces shutdowns,
VRRP switchovers, and port failures.
Configuring IPSec Network Security