Cisco IOS XR Configuration Manual page 141

Implementing IPSec Network Security on Cisco IOS XR Software
DETAILED STEPS
Command or Action
Step 1
configure
Example:
RP/0/0/CPU0:router# configure
Step 2
crypto mib ipsec flowmib history failure size number
Example:
RP/0/0/CPU0:router(config)# crypto mib ipsec flowmib
history failure size 140
How to Implement IPSec Network Security for Locally Sourced
and Destined Traffic
Locally sourced and terminated traffic are evaluated against IPSec profiles that are attached to
tunnel-ipsec interfaces or crypto transport.
Note •
•
This section contains the following procedures:
•
•
•
The any Keyword in Crypto Access Lists
When you create crypto access lists, using the any keyword could cause problems. We discourage the
use of the any keyword to specify source or destination addresses. The any keyword is relevant only to
locally sourced or terminated traffic.
No concept of default access lists exists for IPSec.
The permit any any statement is strongly discouraged, because it causes all outbound traffic to be
protected (and all protected traffic to be sent to the peer specified in the corresponding crypto profile
entry) and requires protection for all inbound traffic. Then, all inbound packets that lack IPSec protection
are silently dropped, including packets for routing protocols, NTP, echo, echo response, and so on.
Multiple profiles can be attached to a tunnel-ipsec interface or crypto transport.
For locally sourced traffic or terminated traffic, we discourage the use of the any keyword to specify
source or destination addresses in the crypto profiles, which are attached to the tunnel-ipsec
interface or transport. This recommendation is only for locally sourced traffic for VPN transit traffic.
You can encrypt all the traffic going through the interface. Therefore, ACLs in profiles, which are
attached to service-ipsec interfaces, can use the any keyword).
The any Keyword in Crypto Access Lists, page SC-129
Applying Crypto Profiles to tunnel-ipsec Interfaces, page SC-130
Applying Crypto Profiles to Crypto Transport, page SC-131
How to Implement IPSec Network Security for Locally Sourced and Destined Traffic
Purpose
Enters global configuration mode.
Sets the size of the failure history table.
Cisco IOS XR System Security Configuration Guide
SC-129