HP Cisco MDS 9216i Cisco MDS 9000 Family CLI Configuration Guide, Release 3.x - Page 871

Chapter 35 Configuring IPsec Network Security Crypto IPv4-ACLs Send documentation comments to [email protected] Step 2 Command switch(config)# crypto transform-set domain ipsec test esp-3des esp-md5-hmac switch(config)# no crypto transform-set domain ipsec test esp-3des esp-md5-hmac switch(config)# crypto transform-set domain ipsec test esp-3des switch(config)# no crypto transform-set domain ipsec test esp-3des Purpose Configures a transform set called test specifying the 3DES encryption algorithm and the MD5 authentication algorithm. Refer to Table 35-2 to verify the allowed transform combinations. Deletes the applied transform set. Configures a transform set called test specifying the 3DES encryption algorithm. In this case, the default no authentication is performed. Deletes the applied transform set. About Crypto Map Entries Once you have created the crypto IPv4-ACLs and transform sets, you can create crypto map entries that combine the various parts of the IPsec SA, including the following: • The traffic to be protected by IPsec (per the crypto IPv4-ACL). A crypto map set can contain multiple entries, each with a different IPv4-ACL. • The granularity of the flow to be protected by a set of SAs. • The IPsec-protected traffic destination (who the remote IPsec peer is). • The local address to be used for the IPsec traffic (applying to an interface). • The IPsec security to be applied to this traffic (selecting from a list of one or more transform sets). • Other parameters to define an IPsec SA. Crypto map entries with the same crypto map name (but different map sequence numbers) are grouped into a crypto map set. When you apply a crypto map set to an interface, the following events occur: • A security policy database (SPD) is created for that interface. • All IP traffic passing through the interface is evaluated against the SPD. If a crypto map entry sees outbound IP traffic that requires protection, an SA is negotiated with the remote peer according to the parameters included in the crypto map entry. The policy derived from the crypto map entries is used during the negotiation of SAs. If the local switch initiates the negotiation, it will use the policy specified in the crypto map entries to create the offer to be sent to the specified IPsec peer. If the IPsec peer initiates the negotiation, the local switch checks the policy from the crypto map entries and decides whether to accept or reject the peer's request (offer). For IPsec to succeed between two IPsec peers, both peers' crypto map entries must contain compatible configuration statements. SA Establishment Between Peers When two peers try to establish an SA, they must each have at least one crypto map entry that is compatible with one of the other peer's crypto map entries. For two crypto map entries to be compatible, they must at least meet the following criteria: OL-16184-01, Cisco MDS SAN-OS Release 3.x Cisco MDS 9000 Family CLI Configuration Guide 35-23