4-3
Cisco 7401ASR Installation and Configuration Guide
OL-5419-01 B0
Chapter4 Configuring the VPN Accele rat ion Module Configuration Tasks
Configuring IPSec
After you have completed IKE configuration, configure IPSec at each participating IPSec peer. This
section contains basic steps to configure IPSec and includes the tasks discussed in the following sect ions:
•Creating Crypto Access Lists, page 4-3
•Defining Transform Sets, page 4-4
•Creating Crypto Map Entries, page 4-5
•Verifying the Configuration, page 4-6
For detailed information on configuring IPSec, refer to the “Configuring IPSec Network Security”
chapter in the Security Configuration Guide publication.

Creating Crypto Access Lists

Crypto access lists define which IP traffic will be protected by encryption.
Note IKE uses UDP port 500. The IPSec Encapsulation Security Prot ocol (E SP) a nd A uthe nti cat ion He ad er
(AH) protocols use protocol numbers 50 and 51. Ens ure t h at y our int erfa ce a c cess l ist s ar e co nfigur ed
so that protocol numbers 50, 51, and UDP port 500 traffic are not blocked at interfaces used by IPSec.
In some cases you might need to add a statement to your access lists to explicitly permit this traffic.
To create crypto access lists, use the following commands in global configuration m ode:
For detailed information on configuring access lists, refer to the “Configuring IPSec Network Security”
chapter in the Security Configuration Guide publication.
Step Command Purpose
Step1 access-list access-list-number {deny |
permit} protocol source
source-wildcard destination
destination-wildcard [log]
or
ip access-list extended name
Specifies conditions to determine which IP
packets are protected.1 (Enable or disable
encryption for traffic that matches these
conditions.)
We recommend that you configure “mirror
image” crypto access lists for use by IPSec and
that you avoid using the any keyword.
1. You specify conditions using anIP access list designated by either a number or a name. The access-list command designates
a numbered extended access list; the ip access-list extended command designates a named access list.
Step2 Add permit and deny statements as
appropriate. Adds permit or deny statements to access lists.
Step3 end Exits the configuration command mode.