Table of Contents
Advertisement
Chapter 11
Configuring Encryption Services
Task
Step 8
Return to global configuration mode.
Step 9
Create an access list.
access_list_number denotes an IP list number
from 1 through 99.
permit or deny specifies permit or deny condition
for this list.
IP-address is the IP address to which the router
compares the address being tested.
wild-mask is the wildcard mask bits for the
address in 32-bit, dotted decimal notation.
1.
A security association (SA) describes how two or more entities will utilize security services to communicate
securely. For example, an IPSec SA defines the encryption algorithm (if used), the authentication algorithm, and
the shared session key to be used during the IPSec connection. Both IPSec and IKE require and use SAs to identify
the parameters of their connections. IKE can negotiate and establish its own SA. The IPSec SA is established
either by IKE or by manual user configuration.
2.
A transform set represents a specific combination of security protocols and algorithms. During the IPSec security
association negotiation, the peers search for a transform set that is the same on both peers. When such a transform
set is found, it is selected and applied to the protected traffic as part of both peers' IPSec security associations.
3.
With IPSec you define what traffic should be protected between two IPSec peers by configuring access lists and
applying these access lists to interfaces by way of crypto map sets. A crypto map set can contain multiple entries,
each with a different access list. The crypto map entries are searched in order, and the Catalyst 4224 attempts to
match the packet to the access list specified in that entry.
4.
Packet filtering helps control packet movement through the network. Such control can help limit network traffic
and restrict network use by certain users or devices. To permit or deny packets from crossing specified interfaces,
Cisco provides access lists. An access list is a sequential collection of permit and deny conditions that apply to IP
addresses.
OL-2031-02
4
Catalyst 4224 Access Gateway Switch Software Configuration Guide
Configuring the Encryption Service Adapter
Command
Gateway(cfg-crypto-trans)# exit
Gateway(config)# access-list
access_list_number {permit | deny}
{type_code wild_mask | address mask}
11-7
Advertisement
Table of Contents
Troubleshooting
