Cisco Systems C7200 manual 4-11, spi cipher hex-key-string authenticator, ipsec-isakmp

Chapter 4 Configuring the VSA

Configuration Tasks

	Command	Purpose
Step 4	Router(config-crypto-m)# set transform-set	Specifies which transform set should be used.
	transform-set-name	This must be the same transform set that is specified
		in the corresponding crypto map entry on the remote
		peer .
		(Only one transform set can be specified when IKE is
		not used.)
Step 5	Router(config-crypto-m)#set session-key inbound ah	Sets the AH Security Parameter Indexes (SPIs) and
	spi hex-key-string	keys to apply to inbound and outbound protected
		traffic if the specified transform set includes the AH
	and	protocol.
	Router(config-crypto-m)#set session-key outbound ah	(This manually specifies the AH security association
	spi hex-key-string	to be used with protected traffic.)
Step 6	Router(config-crypto-m)#set session-key inbound esp	Sets the ESP Security Parameter Indexes (SPIs) and
	spi cipher hex-key-string[authenticator	keys to apply to inbound and outbound protected
	hex-key-string]	traffic if the specified transform set includes the ESP
	and	protocol. Specifies the cipher keys if the transform
		set includes an ESP cipher algorithm. Specifies the
	Router(config-crypto-m)# set session-key outbound
		authenticator keys if the transform set includes an
	esp spi cipher hex-key-string[authenticator
		ESP authenticator algorithm.
	hex-key-string]
		(This manually specifies the ESP security association
		to be used with protected traffic.)
Step 7	Router(config-crypto-m)# exit	Exits crypto-map configuration mode and return to
		global configuration mode.

To create crypto map entries that will use IKE to establish the security associations, use the following commands starting in global configuration mode:

	Command	Purpose
Step 1	Router(config)# crypto map map-nameseq-num	Names the crypto map entry to create (or modify).
	ipsec-isakmp	This command puts you into the crypto map
		configuration mode.
Step 2	Router(config-crypto-m)# match address	Names an extended access list. This access list
	access-list-id	determines which traffic should be protected by
		IPSec and which traffic should not be protected by
		IPSec security in the context of this crypto map entry.
Step 3	Router(config-crypto-m)# set peer {hostname	Specifies a remote IPSec peer. This is the peer to
	ip-address}	which IPSec protected traffic can be forwarded.
		Repeat for multiple remote peers.
Step 4	Router(config-crypto-m)# set transform-set	Specifies which transform sets are allowed for this
	transform-set-name1	crypto map entry. List multiple transform sets in
	[transform-set-name2...transform-set-name6]	order of priority (highest priority first).

C7200 VSA (VPN Services Adapter) Installation and Configuration Guide

OL-9129-02 4-11