Cisco CRS-1 - Carrier Routing System Router Configuration Manual page 151

Implementing Internet Key Exchange Security Protocol on Cisco IOS XR Software
Configuring a service-ipsec Interface with a Dynamic Profile: Example
The following shows how to configure a service-ipsec interface with a dynamic profile:
ipv4 access-list acl1
10 permit ipv4 any any
!
interface service-ipsec1
ipv4 address 44.44.44.44 255.255.255.0
profile ipsec-profile1
tunnel source 100.0.0.1
service-location preferred-active 0/4/0
!
crypto isakmp
crypto isakmp policy 10
authentication pre-share
group 5
encryption 3des
lifetime 86400
!
crypto keyring ring1 vrf default
pre-shared-key address 40.0.0.1 255.255.255.255 key key1
!
crypto isakmp profile ike-profile1
keyring ring1
match identity address 40.0.0.0/16 vrf default
set interface service-ipsec1
!
!
crypto isakmp keepalive 60 5
crypto ipsec transform-set tsfm1 esp-3des esp-md5-hmac
!
crypto ipsec profile ipsec-profile1
set type dynamic
match acl1 transform-set tsfm1
!
The service-ipsec interface is supported only on the Cisco XR 12000 Series Router.
Note
Limiting an IKE Peer to a Particular Policy Set Based on Local IP Address:
Example
The first part consists of selecting an ISAKMP policy related to the encryption method and identifying
the SVI tunnel source. Users connecting to IP address 1.1.1.1 in the following example experience DES
as the ISAKMP policy. However, users connecting to IP address 2.2.2.2 experience only AES as the
ISAKMP policy.
More than one ISAKMP policy, or more than one IP address, can be used for matches. The rest of
configuration remains the same; in other words, the configuration of the ISAKMP profile that matches
a group name set to an SVI.
In this particular example, two policies have been configured in the policy set (policy 10 and 20).
Note that the SVI1 and SVI2 tunnel sources are respectively identified in bold as local-address 1.1.1.1
and local-address 2.2.2.2 in the example below.
RP/0/RP0/CPU0:router: configure
RP/0/RP0/CPU0:router(config)# crypto isakmp policy 10
OL-20382-01
Configuration Examples for Implementing IKE Security Protocol
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
SC-145