Table of Contents
Advertisement
Crypto Map Mode Commands
Sample Output
The following output displays when a master key is generated:
XSR(config)#crypto key master generate
New key is 8573 4583 3994 2ff5
A script displays when a master key is specified, prompting you for the following information:
XSR(config)#crypto key master specify
Specify first encryption key in hex digits:
Specify second encryption key in hex digits:
Specify third encryption key in hex digits:
Are you sure?
Crypto Map Mode Commands
crypto map (Global IPSec)
This command creates or modifies a crypto map entry. It also acquires Crypto Map mode. Along
with the setting of a transform‐set, this constitutes IPSec Phase 2 configuration.
In Crypto Map mode, the following sub‐commands are available:
•
match address
•
mode
page 14‐112 for the command definition.
set peer
•
set security-association level per-host
•
source/destination host pair. Refer to page 14‐114 for the command definition.
•
set transform-set
command definition.
Crypto Map
Crypto maps provide two functions: filter and classify traffic to be protected as well as define the
policy to be applied to that traffic. The first use affects the flow of traffic on an interface; the second
affects the negotiation performed (via IKE) on behalf of that traffic.
IPSec crypto maps link definitions of the following:
•
Which traffic should be protected.
•
Which IPSec peers the protected traffic can be forwarded to ‐ these are the peers with which a
Security Association (SA) can be built.
•
Which transform‐sets are acceptable for use with the protected traffic.
•
How keys and SAs should be used or managed.
14-110 Configuring the VPN
183b 4bdf fe92 dbc1
1132 ffe0 f8d9 3759
[y]:
‐ Correlates ACLs to map. Refer to page 14‐111 for the command definition.
‐ Selects encapsulation type ‐ tunnel or transport‐ for a transform‐set. Refer to
‐ Specifies peer's IP address. Refer to page 14‐113 for the command definition.
‐ Correlates transform‐sets with map. Refer to page 14‐114 for the
Note: A crypto map has no effect until it is attached to an interface.
[]: 8573 4583 3994 2ff5
[]: 183b 4bdf fe92 dbc1
[]: 1132 ffe0 f9d9 3759
‐ Specifies separate SAs be requested for each
Advertisement
Table of Contents
