Cisco Systems C819GUK9 Configure IPSec Transforms and Protocols, 13-8, Summary Steps, Purpose

Chapter 13 Configuring a VPN Using Easy VPN and an IPSec Tunnel

Configuration Tasks

Configure IPSec Transforms and Protocols

A transform set represents a certain combination of security protocols and algorithms. During IKE negotiation, the peers agree to use a particular transform set for protecting data flow.

During IKE negotiations, the peers search in multiple transform sets for a transform that is the same at both peers. When such a transform set is found, it is selected and applied to the protected traffic as a part of both peers’ configurations.

Perform these steps to specify the IPSec transform set and protocols, beginning in global configuration mode:

SUMMARY STEPS

1.crypto ipsec transform-settransform-set-name transform1 [transform2] [transform3] [transform4]

2.crypto ipsec security-association lifetime {seconds seconds kilobytes kilobytes}

DETAILED STEPS

	Command or Action	Purpose
Step 1
	crypto ipsec transform-set	Defines a transform set—an acceptable
	transform-set-name transform1 [transform2]	combination of IPSec security protocols and
	[transform3] [transform4]	algorithms.
	Example:	See Cisco IOS Security Command Reference for
	Router(config)# crypto ipsec transform-set	details about the valid transforms and
		combinations.
	vpn1 esp-3des esp-sha-hmac
	Router(config)#
Step 2
	crypto ipsec security-association lifetime	Specifies global lifetime values used when IPSec
	{seconds seconds kilobytes kilobytes}	security associations are negotiated.
	Example:	See Cisco IOS Security Command Reference for
		details.
	Router(config)# crypto ipsec
	security-association lifetime seconds 86400
	Router(config)#

Note With manually established security associations, there is no negotiation with the peer, and both sides must specify the same transform set.

Configure the IPSec Crypto Method and Parameters

A dynamic crypto map policy processes negotiation requests for new security associations from remote IPSec peers, even if the router does not know all the crypto map parameters (for example, IP address).

Perform these steps to configure the IPSec crypto method, beginning in global configuration mode:

	Cisco 819 Integrated Services Routers Software Configuration Guide
13-8	OL-23590-02