Step 3-4 Configure Crypto Maps
Crypto map entries must be created for IPSec to set up SAs
for traffic flows that must be protected. Crypto map entries created for IPSec
set up security association parameters, tying together the various parts
configured for IPSec, including
-
Which traffic should be protected by IPSec (crypto ACL)
-
Which IPSec peers the protected traffic can be forwarded
to—the peers with which a security association can be established
-
Which transform sets are to be used with the protected
traffic
-
How keys and security associations should be used or managed
(or what the keys are, if IKE isn’t used)
-
Other parameters that might be necessary to define an IPSec
SA
As with applying packet filtering, it’s only possible to apply one
crypto map set to a particular interface. You can apply the same crypto map to
multiple interfaces to apply the same policy to all included interfaces. The
crypto map set can include a combination of IPSec using IKE and IPSec with
manually configured SA entries.
To create more than one crypto map entry for a particular
interface, use a unique sequence number (seq-num) of each map entry. The number
assigned to the seq-num shouldn’t be arbitrary; it’s used to rank multiple
crypto map entries within a crypto map set. Within a crypto map set, a crypto
map entry with a lower seq-num has a higher priority and is evaluated before a
map entry with a higher seq-num. Be sure to space the sequence numbers to allow
for future technology to be inserted without having to completely
reconfigure.
Use the global crypto map command to create a
crypto map entry and enter the Crypto Map Configuration mode. Use the no form of
the command to delete a crypto map entry or set. Use the crypto
map map-name seq-num command without a keyword to modify
an existing crypto map entry. Once a crypto map entry is created, you can’t
change the global configuration parameters because those parameters determine
which configuration commands are valid at the crypto map
level. For example, once a map entry is created as ipsec-isakmp, it can’t be
changed to ipsec-manual. It must be deleted and reentered.
The command syntax follows:
Rtr1(config)#crypto map map-name
seq-num ipsec-manual
Rtr1(config)#crypto map map-name seq-num ipsec-isakmp [dynamic dynamic-map-name][discover]
Rtr1(config)#no crypto map map-name
[seq-num]
By default, no crypto maps exist and peer discovery isn’t
enabled.
After typing the crypto map command, the Crypto
Map Configuration mode is invoked, as shown in the following output:
Rtr1(config)#crypto map testmap 50 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
Rtr1(config-crypto-map)#
From here, the set command can be used to define
the crypto map parameters. You can also add a description, a match statement to
link the crypto ACL that defines the traffic, and, finally, exit to end the
session. The following example demonstrates pulling choices from the earlier
exercises:
Rtr1(config)#crypto map testmap 50 ipsec-isakmp
Rtr1(config-crypto-map)#description VPN Link to branch in Tacoma, WA
Rtr1(config-crypto-map)#set peer 10.0.50.2
Rtr1(config-crypto-map)#set security-association lifetime seconds 1800
Rtr1(config-crypto-map)#set pfs group2
Rtr1(config-crypto-map)#set transform-set CPU-HOG
Rtr1(config-crypto-map)#match address 125
Rtr1(config-crypto-map)#exit
Rtr1(config)#
This next example demonstrates creating a second crypto map entry
for testmap that creates a VPN to San Antonio, TX. Because
of the larger seq-num (100), this choice is always considered after the original
entries.
Rtr1(config)#crypto map testmap 100 ipsec-isakmp
Rtr1(config-crypto-map)#description VPN Link to branch in San Antonio, TX
Rtr1(config-crypto-map)#set peer 10.1.195.130
Rtr1(config-crypto-map)#set security-association lifetime seconds 2700
Rtr1(config-crypto-map)#set pfs group2
Rtr1(config-crypto-map)#set transform-set DES-ONLY
Rtr1(config-crypto-map)#match address 150
Rtr1(config-crypto-map)#exit
After crypto map entries are defined, the crypto map set is
assigned to interfaces using the crypto map (interface IPSec)
command, covered in the next section.
Sections
Comments (0 posted)
Syndication
