Enterasys Networks XSR CLI match address

Crypto Map Mode Commands
XSR CLI Reference Guide 14-111
Crypto Map Rules
Acryptomapisacollectionofrules,eachwithadifferentseq‐numbutthesamemap‐name.So,for
agiveninterface,youcanhavecertaintrafficforwardedtooneIPSecpeerwithspecifiedsecurity
appliedtothattraffic,andothertrafficforwardedtothesameoradifferentIPSecpeerwith
differentIPSecsecurityapplied.Toaccomplishthisyoucreatetwocryptomaps,eachwiththe
samemap‐name,buteachwithadifferentseq‐num.Cryptomaprulesaresearchedinorderofseq‐
num.Sequencenumbers,inadditiontodeterminingtheorderinwhichtrafficistestedagainstthe
rules,areusedasananti‐replaydevicetorejectduplicateandoldpacketsandsopreventan
intruderfromcopyingaconversationandusingittoworkoutencryptionalgorithms.
Syntax
crypto map map-name seq-num [ipsec-isakmp]
Syntax of the “no” Form
Todeleteacryptomapentry,usethenoformofthiscommand:
no crypto map map-name [seq-num]
Mode
Globalconfiguration:XSR(config)#
Next Mode
CryptoMapconfiguration: XSR(config-crypto-m)#
Sample Output
Thefollowingexample���createsthecryptomapACMEmap:
XSR(config)#crypto map ACMEmap 7
XSR(config-crypto-m)#set transform-set esp-3des-sha
XSR(config-crypto-m)#match address 120
match address
Thiscommandspecifiesanaccesscontrollist(ACL)foracryptomapentry.AnACLisapplied
bidirectionallybyIPSecandtheXSRconsidersits“source”asthelocaladdressandits“destination”
astheremoteaddresssotypicallyonlyonematchaddressandACLisneededtodefinetrafficwith
apeer.
Syntax
match address [access-list-id]
map-name Cryptomapidentification.Thisisthenameassignedwhenthecrypto
mapwascreated.
seq-num 32‐bitdigityouassigntothecryptomap.Range:1to4096.
ipsec-isakmp Thisvalueprovidesbackwardcompatibilitywiththeindustry‐standard
CLI.Itisnotmandatory.