Cisco CRS-1 - Carrier Routing System Router Configuration Manual page 126

How to Implement IKE Security Protocol Configurations for IPSec Networks
Note
4.
5.
6.
7.
DETAILED STEPS
Command or Action
Step 1
configure
Step 2
crypto isakmp policy-set policy-name
Example:
RP/0/RP0/CPU0:router(config)# crypto isakmp
policy-set policy_1
Step 3
policy policy number
Example:
RP/0/RP0/CPU0:router(config-isakmp-pol-set)# policy
10
Step 4
match identity local-address A.B.C.D IP address
Example:
RP/0/RP0/CPU0:router(config-isakmp-pol-set)# match
identity local-address 10.56.8.10
Step 5 (Optional) Repeat
configure additional policy sets for specific IP addresses.
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
SC-120
In this step, you can identify up to five previously configured ISAKMP policies to match.
match identity local-address A.B.C.D IP address
(Optional) Repeat Step 2 through
IP addresses.
end
or
commit
exit
Step 2 through Step 4, as needed, to
Implementing Internet Key Exchange Security Protocol on Cisco IOS XR Software
Step 4, as needed, to configure additional policy sets for specific
Purpose
Enters global configuration mode.
Enters the global crypto configuration mode to
create a new policy set by naming it.
Identifies up to five ISAKMP policies by the match
priority number you gave them in
Policies, page
five policies.)
Only these policies can be part of the IKE
negotiation between the local and the remote peer.
Identifies the SVI tunnel source to be restricted to a
particular policy set.
When users connect to the IP address
Note
identified in this step, the ISAKMP policies
configured in the policy set defined in
becomes part of the IKE negotiation.
You may use either multiple ISAKMP policies or
multiple IP addresses to create the match.
Configuring IKE
117. (A policy set can contain up to
Step 2
OL-20382-01