Cisco Systems Creating an IPsec Rule/Tunnel Policy (Crypto Map) - Basic Tab

68-14
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter68 Configuring IKE, Load Balancing, and NAC
Configuring IPsec
Creating an IPsec Rule/Tunnel Policy (Crypto Map) - Basic Tab
Use this pane to define a new Tunnel Policy for an IPsec rule. The values you define here appear in the
IPsec Rules table after you click OK. All rules are enabled by default as soon as they appear in the IPsec
Rules table.
The Tunnel Policy pane lets you define a tunnel policy that is used to negotiate an IPsec (Phase 2)
security association (SA). ASDM captures your configuration edits, but does not save them to the
running configuration until you click Apply.
Every tunnel policy must specify a transform set and identify the security appliance interface to which
it applies. The transform set identifies the encryption and hash algorithms that perform IPsec encryption
and decryption operations. Because not every IPsec peer supports the same algorithms, you might want
to specify a number of policies and assign a priority to each. The security appliance then negotiates with
the remote IPsec peer to agree on a transform set that both peers support.
Tunnel policies can be static or dynamic. A static tunnel policy identifies one or more remote IPsec peers
or subnetworks to which your security appliance permits IPsec connections. A static policy can be used
whether your security appliance initiates the connection or receives a connection request from a remote
host. A static policy requires you to enter the information necessary to identify permitted hosts or
networks.
A dynamic tunnel policy is used when you cannot or do not want to provide information about remote
hosts that are permitted to initiate a connection with the security appliance. If you are only using your
security appliance as a VPN client in relation to a remote VPN central-site device, you do not need to
configure any dynamic tunnel policies. Dynamic tunnel policies are most useful for allowing remote
access clients to initiate a connection to your network through a security appliance acting as the VPN
central-site device. A dynamic tunnel policy is useful when the remote access clients have dynamically
assigned IP addresses or when you do not want to configure separate policies for a large number of
remote access clients.
Fields
•Interface—Choose the interface name to which this policy applies.
•Policy Type—Choose the type, static or dynamic, of this tunnel policy.
•Priority—Enter the priority of the policy.
•IKE Proposals (Transform Sets)--Specifies IKEv1 and IKEv2 IPsec proposals:
– IKEv1 IPsec Proposal—Choose the proposal (transform set) for the policy and click Add to
move it to the list of active transform sets. Click Move Up or Move Down to rearrange the order
of the proposals in the list box. You can add a maximum of 11 proposals to a crypto map entry
or a dynamic crypto map entry.
– IKEv2 IPsec Proposal—Choose the proposal (transform set) for the policy and click Add to
move it to the list of active transform sets. Click Move Up or Move Down to rearrange the order
of the proposals in the list box. You can add a maximum of 11 proposals to a crypto map entry
or a dynamic crypto map entry.
•Peer Settings - Optional for Dynamic Crypto Map Entries—Configure the peer settings for the
policy.
– Connection Type—(Meaningful only for static tunnel policies.) Choose bidirectional,
originate-only, or answer-only to specify the connection type of this policy. For LAN-to-LAN
connections, choose bidirectional or answer-only (not originate-only). Choose answer-only for
LAN-to-LAN redundancy.
– IP Address of Peer to Be Added—Enter the IP address of the IPsec peer you are adding.