Chapter 6 Configuring a VPN Using Easy VPN and an IPSec Tunnel

Configure the IPSec Crypto Method and Parameters

BETA DRAFT - CISCO CONFIDENTIAL

Perform these steps to specify the IPSec transform set and protocols, beginning in global configuration mode:

 

Command or Action

Purpose

Step 1

 

 

crypto ipsec transform-set transform-set-name

Defines a transform set—an acceptable

 

transform1 [transform2] [transform3]

combination of IPSec security protocols and

 

[transform4]

algorithms.

 

Example:

See the Cisco IOS Security Command Reference

 

for detail about the valid transforms and

 

 

 

Router(config)# crypto ipsec transform-set

combinations.

 

vpn1 esp-3des esp-sha-hmac

 

 

Router(config)#

 

Step 2

 

 

crypto ipsec security-association lifetime

Specifies global lifetime values used when IPSec

 

{seconds seconds kilobytes kilobytes}

security associations are negotiated.

 

Example:

See the Cisco IOS Security Command Reference

 

for details.

 

 

 

Router(config)# crypto ipsec

 

 

security-association lifetime seconds 86400

 

 

Router(config)#

 

 

 

 

Note With manually established security associations, there is no negotiation with the peer, and both sides must specify the same transform set.

Configure the IPSec Crypto Method and Parameters

A dynamic crypto map policy processes negotiation requests for new security associations from remote IPSec peers, even if the router does not know all the crypto map parameters (for example, IP address).

Perform these steps to configure the IPSec crypto method, beginning in global configuration mode:

 

Command or Action

Purpose

Step 1

 

 

crypto dynamic-map dynamic-map-name

Creates a dynamic crypto map entry and enters

 

dynamic-seq-num

crypto map configuration mode.

 

Example:

See the Cisco IOS Security Command Reference

 

for more detail about this command.

 

 

 

Router(config)# crypto dynamic-map dynmap 1

 

 

Router(config-crypto-map)#

 

Step 2

 

 

set transform-set transform-set-name

Specifies which transform sets can be used with

 

[transform-set-name2...transform-set-name6]

the crypto map entry.

 

Example:

 

 

Router(config-crypto-map)# set

 

 

transform-set vpn1

 

 

Router(config-crypto-map)#

 

 

 

 

Cisco 1800 Series Integrated Services Routers (Fixed) Software Configuration Guide

 

OL-6426-02

6-7

 

 

 

Page 79
Image 79
Cisco Systems OL-6426-02 manual Configure the IPSec Crypto Method and Parameters