Cisco CISCO876-SEC-I-K9 Configuration Guide - Page 84

crypto ipsec transform-set, crypto ipsec security-association lifetime, seconds, kilobytes

Get Cisco CISCO876-SEC-I-K9 - 876 Security Bundle Router PDF manuals and user guides
UPC - 882658021800
View all Cisco CISCO876-SEC-I-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 84 highlights

Configure a VPN Chapter 7 Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation Perform these steps to specify the IPSec transform set and protocols, beginning in global configuration mode: Step 1 Command or Action crypto ipsec transform-set transform-set-name transform1 [transform2] [transform3] [transform4] Example: Router(config)# crypto ipsec transform-set vpn1 esp-3des esp-sha-hmac Router(config)# Purpose Defines a transform set-An acceptable combination of IPSec security protocols and algorithms. See the Cisco IOS Security Command Reference for detail about the valid transforms and combinations. Step 2 crypto ipsec security-association lifetime {seconds seconds | kilobytes kilobytes} Specifies global lifetime values used when negotiating IPSec security associations. Example: Router(config)# crypto ipsec security-association lifetime seconds 86400 Router(config)# See the Cisco IOS Security Command Reference for details. Note With manually established security associations, there is no negotiation with the peer, and both sides must specify the same transform set. Configure the IPSec Crypto Method and Parameters A dynamic crypto map policy processes negotiation requests for new security associations from remote IPSec peers, even if the router does not know all the crypto map parameters (for example, IP address). Perform these steps to configure the IPSec crypto method, beginning in global configuration mode: Step 1 Command or Action Purpose crypto dynamic-map dynamic-map-name dynamic-seq-num Creates a dynamic crypto map entry, and enters crypto map configuration mode. Example: Router(config)# crypto dynamic-map dynmap 1 Router(config-crypto-map)# See the Cisco IOS Security Command Reference for more detail about this command. Step 2 set transform-set transform-set-name [transform-set-name2...transform-set-name6] Specifies which transform sets can be used with the crypto map entry. Example: Router(config-crypto-map)# set transform-set vpn1 Router(config-crypto-map)# Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide 7-6 OL-5332-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
7-6
Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide
OL-5332-01
Chapter 7
Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation
Configure a VPN
Perform these steps to specify the IPSec transform set and protocols, beginning in global configuration
mode:
Command or Action
Purpose
Step 1
crypto ipsec transform-set
transform-set-name
transform1
[
transform2
] [
transform3
]
[
transform4
]
Example:
Router(config)#
crypto ipsec transform-set
vpn1 esp-3des esp-sha-hmac
Router(config)#
Defines a transform set—An acceptable
combination of IPSec security protocols and
algorithms.
See the
Cisco IOS Security Command Reference
for detail about the valid transforms and
combinations.
Step 2
crypto ipsec security-association lifetime
{
seconds
seconds
|
kilobytes
kilobytes
}
Example:
Router(config)#
crypto ipsec
security-association lifetime seconds
86400
Router(config)#
Specifies global lifetime values used when
negotiating IPSec security associations.
See the
Cisco IOS Security Command Reference
for details.
Note
With manually established security associations, there is no negotiation with the peer, and both sides
must specify the same transform set.
Configure the IPSec Crypto Method and Parameters
A dynamic crypto map policy processes negotiation requests for new security associations from remote
IPSec peers, even if the router does not know all the crypto map parameters (for example, IP address).
Perform these steps to configure the IPSec crypto method, beginning in global configuration mode:
Command or Action
Purpose
Step 1
crypto dynamic-map
dynamic-map-name
dynamic-seq-num
Example:
Router(config)#
crypto dynamic-map
dynmap 1
Router(config-crypto-map)#
Creates a dynamic crypto map entry, and enters
crypto map configuration mode.
See the
Cisco IOS Security Command Reference
for more detail about this command.
Step 2
set transform-set
transform-set-name
[
transform-set-name2...transform-set-name6
]
Example:
Router(config-crypto-map)#
set
transform-set
vpn1
Router(config-crypto-map)#
Specifies which transform sets can be used with
the crypto map entry.