Chapter 13 Configuring a VPN Using Easy VPN and an IPSec Tunnel
Configuration Tasks
Configure IPSec Transforms and Protocols
A transform set represents a certain combination of security protocols and algorithms. During IKE negotiation, the peers agree to use a particular transform set for protecting data flow.
During IKE negotiations, the peers search in multiple transform sets for a transform that is the same at both peers. When such a transform set is found, it is selected and applied to the protected traffic as a part of both peers’ configurations.
Perform these steps to specify the IPSec transform set and protocols, beginning in global configuration mode:
SUMMARY STEPS
1.crypto ipsec
2.crypto ipsec
DETAILED STEPS
| Command or Action | Purpose |
Step 1 |
|
|
crypto ipsec | Defines a transform | |
| combination of IPSec security protocols and | |
| [transform3] [transform4] | algorithms. |
|
| |
| Example: | See Cisco IOS Security Command Reference for |
| Router(config)# crypto ipsec | details about the valid transforms and |
| combinations. | |
| vpn1 | |
| Router(config)# |
|
Step 2 |
|
|
crypto ipsec | Specifies global lifetime values used when IPSec | |
| {seconds seconds kilobytes kilobytes} | security associations are negotiated. |
| Example: | See Cisco IOS Security Command Reference for |
| details. | |
| Router(config)# crypto ipsec | |
|
| |
|
| |
| Router(config)# |
|
|
|
|
Note With manually established security associations, there is no negotiation with the peer, and both sides must specify the same transform set.
Configure the IPSec Crypto Method and Parameters
A dynamic crypto map policy processes negotiation requests for new security associations from remote IPSec peers, even if the router does not know all the crypto map parameters (for example, IP address).
Perform these steps to configure the IPSec crypto method, beginning in global configuration mode:
| Cisco 819 Integrated Services Routers Software Configuration Guide |
|
|