Enterasys Networks XSR CLI Crypto Map Mode Commands crypto map (Global IPSec)

Crypto Map Mode Commands

14-110 Configuring the VPN

Sample Output

Thefollowingoutputdisplayswhenamasterkeyisgenerated:

XSR(config)#crypto key master generate

New key is 8573 4583 3994 2ff5

183b 4bdf fe92 dbc1

1132 ffe0 f8d9 3759

Ascriptdisplayswhenamasterkeyisspecified,promptingyouforthefollowinginformation:

XSR(config)#crypto key master specify

Specify first encryption key in hex digits: []: 8573 4583 3994 2ff5

Specify second encryption key in hex digits: []: 183b 4bdf fe92 dbc1

Specify third encryption key in hex digits: []: 1132 ffe0 f9d9 3759

Are you sure? [y]:

Crypto Map Mode Commands

Thiscommandcreatesormodifiesacryptomapentry.ItalsoacquiresCryptoMapmode.Along

withthesettingofatransform‐set,thisconstitutesIPSecPhase2configuration.

InCryptoMapmode,thefollowingsub‐commandsareavailable:

•match address ‐CorrelatesACLstomap.Refertopage14‐111forthecommanddefinition.

•mode ‐Selectsencapsulationtype‐tunnelortransport‐foratransform‐set.Referto

page14‐112forthecommanddefinition.

•set peer ‐Specifiespeer’sIPaddress.Refertopage14‐113forthecommanddefinition.

•set security-association level per-host ‐SpecifiesseparateSAsberequestedforeach

source/destinationhostpair.Refertopage14‐114forthecommanddefinition.

•set transform-set ‐Correlatestransform‐setswithmap.Refertopage14‐114forthe

commanddefinition.

Cryptomapsprovidetwofunctions:filterandclassifytraffictobeprotectedaswellasdefinethe

policytobeappliedtothattraffic.Thefirstuseaffectstheflowoftrafficonaninterface;thesecond

affectsthenegotiationperformed(viaIKE)onbehalfofthattraffic.

IPSeccryptomapslinkdefinitionsofthefollowing:

•Whichtrafficshouldbeprotected.

•WhichIPSecpeerstheprotectedtrafficcanbeforwardedto‐thesearethepeerswithwhicha

SecurityAssociation(SA)canbebuilt.

•Whichtransform‐setsareacceptableforusewiththeprotectedtraffic.

•HowkeysandSAsshouldbeusedormanaged.

Note: A crypto map has no effect until it is attached to an interface.