Cisco Systems OL-6426-02 manual Configure the IPSec Crypto Method and Parameters, Map entry

Chapter 7 Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation

Configure a VPN

BETA DRAFT - CISCO CONFIDENTIAL

Note With manually established security associations, there is no negotiation with the peer, and both sides must specify the same transform set.

Configure the IPSec Crypto Method and Parameters

A dynamic crypto map policy processes negotiation requests for new security associations from remote IPSec peers, even if the router does not know all the crypto map parameters (for example, IP address).

Perform these steps to configure the IPSec crypto method, beginning in global configuration mode:

	Command or Action	Purpose
Step 1
	crypto dynamic-map dynamic-map-name	Creates a dynamic crypto map entry, and enters
	dynamic-seq-num	crypto map configuration mode.
	Example:	See the Cisco IOS Security Command Reference
		for more detail about this command.
	Router(config)# crypto dynamic-map dynmap 1
	Router(config-crypto-map)#
Step 2
	set transform-set transform-set-name	Specifies which transform sets can be used with
	[transform-set-name2...transform-set-name6]	the crypto map entry.
	Example:
	Router(config-crypto-map)# set
	transform-set vpn1
	Router(config-crypto-map)#
Step 3
	reverse-route	Creates source proxy information for the crypto
		map entry.
	Example:	See the Cisco IOS Security Command Reference
	Router(config-crypto-map)# reverse-route	for details.
	Router(config-crypto-map)#
Step 4
	exit	Enters global configuration mode.
	Example:
	Router(config-crypto-map)# exit
	Router(config)#
Step 5
	crypto map map-nameseq-num[ipsec-isakmp]	Creates a crypto map profile.
	[dynamic dynamic-map-name] [discover]
	[profile profile-name]
	Example:
	Router(config)# crypto map static-map 1
	ipsec-isakmp dynamic dynmap
	Router(config)#

Cisco 1800 Series Integrated Services Routers (Fixed) Software Configuration Guide

OL-6426-02 7-7