Cisco CRS-1 - Carrier Routing System Router Configuration Manual page 98

How to Implement General IPSec Configurations for IPSec Networks
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
DETAILED STEPS
Command or Action
Step 1
configure
Example:
RP/0/RP0/CPU0:router# configure
Step 2
crypto ipsec profile name
Example:
RP/0/RP0/CPU0:router(config)# crypto ipsec
profile new
Step 3
match acl-name transform-set transform-set-name
Example:
RP/0/RP0/CPU0:router(config-new)# match
sampleacl transform-set tset1
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
SC-92
set transform-set transform-set-name
reverse-route
set security-association idle-time seconds
set security-association lifetime seconds seconds kilobytes kilobytes
set security-association replay disable
set session-key inbound ah spi hex-key-data
set session-key inbound esp spi {cipher hex-key-data authentication hex-key-data}
set session-key outbound ah spi hex-key-data
set session-key outbound esp spi {cipher hex-key-data authentication hex-key-data}
exit
end
or
commit
show crypto ipsec sa [sa-id | peer ip-address | profile profile-name | detail | fvrf fvrf-name | ivrf
ivrf-name | location location]
show crypto ipsec summary
Implementing IPSec Network Security on Cisco IOS XR Software
Purpose
Enters global configuration mode.
Creates the IPSec profile and enters profile configuration
mode.
Configures the ACL to use for packet classification, and if
the packets need protecting, the transform set to use for
IPSec processing.
You can configure up to five different
Note
transform-sets.
The match transform-set command is used in profiles that
are attached to service-ipsec interfaces, tunnel-ipsec
interfaces, and transport. The description for this command
is similar to the set transform-set command but used on a
different interface.
OL-20382-01