Cisco Systems 7401ASR manual Creating Crypto Map Entries

Chapter 4 Configuring the VPN Acceleration Module

Configuration Tasks

Table 4-1 Allowed Transform Combinations (continued)

AH Transform1		ESP Encryption Transform1		ESP Authentication Transform2
ah-sha-hmac	AH with SHA	esp-des	ESP with 56-bit DES	esp-sha-hmac	ESP with SHA
	(HMAC variant)		encryption algorithm		(HMAC variant)
	authentication				authentication
	algorithm				algorithm
		esp-null	ESP transform without
			cipher

1.Pick one transform option.

2.Pick one transform option, but only if you selected esp-nullor ESP encrypting transform.

Creating Crypto Map Entries

To create crypto map entries that use IKE to establish the security associations, use the following commands, starting in global configuration mode:

	Command	Purpose
Step 1	crypto map map-name seq-num	Creates the crypto map and enters crypto map
	ipsec-isakmp	configuration mode.
Step 2	match address access-list-id	Specifies an extended access list. This access
		list determines which traffic is protected by
		IPSec and which is not.
Step 3	set peer {hostname ip-address}	Specifies a remote IPSec peer. This is the peer
		to which IPSec-protected traffic can be
		forwarded.
		Repeat for multiple remote peers.
Step 4	set transform-settransform-set-name1	Specifies which transform sets are allowed for
	[transform-set-name2...transform-set-na	this crypto map entry. Lists multiple transform
	me6]	sets in order of priority (highest priority first).
Step 5	end	Exits crypto map configuration mode.
Step 6	Repeat these steps to create additional crypto map entries as required.

Cisco 7401ASR Installation and Configuration Guide

OL-5419-01 B0 4-5