64-32
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter64 Configuring IPsec and ISAKMP
Configuring IPsec
•Peers with dynamically assigned private IP addresses.
Peers requesting remote access tunnels typically have private IP addresses assigned by the headend.
Generally, LAN-to-LAN tunnels have a predetermined set of private networks that are used to
configure static maps and therefore used to establish IPsec SAs.
As an administrator configuring static crypto maps, you might not know the IP addresses that are
dynamically assigned (via DHCP or some other method), and you might not know the private IP
addresses of other clients, regardless of how they were assigned. VPN clients typically do not have static
IP addresses; they require a dynamic crypto map to allow IPsec negotiation to occur. For example, the
headend assigns the IP address to a Cisco VPN client during IKE negotiation, which the client then uses
to negotiate IPsec SAs.
Note A dynamic crypto map requires only the transform-set parameter.
Dynamic crypto maps can ease IPsec configuration, and we recommend them for use in networks where
the peers are not always predetermined. Use dynamic crypto maps for Cisco VPN clients (such as mobile
users) and routers that obtain dynamically assigned IP addresses.
Tip Use care when using the any keyword in permit entries in dynamic crypto maps. If the traffic covered
by such a permit entry could include multicast or broadcast traffic, insert deny entries for the
appropriate address range into the access list. Remember to insert deny entries for network and subnet
broadcast traffic, and for any other traffic that IPsec should not protect.
Dynamic crypto maps work only to negotiate SAs with remote peers that initiate the connection. The
ASA cannot use dynamic crypto maps to initiate connections to a remote peer. With a dynamic crypto
map, if outbound traffic matches a permit entry in an access list and the corresponding SA does not yet
exist, the ASA drops the traffic.
A crypto map set may include a dynamic crypto map. Dynamic crypto map sets should be the lowest
priority crypto maps in the crypto map set (that is, they should have the highest sequence numbers) so
that the ASA evaluates other crypto maps first. It examines the dynamic crypto map set only when the
other (static) map entries do not match.
Similar to static crypto map sets, a dynamic crypto map set consists of all of the dynamic crypto maps
with the same dynamic-map-name. The dynamic-seq-num differentiates the dynamic crypto maps in a
set. If you configure a dynamic crypto map, insert a permit ACL to identify the data flow of the IPsec
peer for the crypto access list. Otherwise the ASA accepts any data flow identity the peer proposes.
Caution Do not assign module default routes for traffic to be tunneled to a ASA interface configured with a
dynamic crypto map set. To identify the traffic that should be tunneled, add the ACLs to the dynamic
crypto map. Use care to identify the proper address pools when configuring the ACLs associated with
remote access tunnels. Use Reverse Route Injection to install routes only after the tunnel is up.
The procedure for using a dynamic crypto map entry is the same as the basic configuration described in
“Creating a Basic IPsec Configuration,” except that instead of creating a static crypto map, you create a
dynamic crypto map entry. You can also combine static and dynamic map entries within a single crypto
map set.
Create a crypto dynamic map entry as follows:
Step1 (Optional) Assign an access list to a dynamic crypto map: