Crypto map mode commands, Crypto map mode commands -110, Crypto map mode commands crypto map (global ipsec) – Enterasys Networks X-Pedition XSR CLI User Manual
Page 564
Crypto Map Mode Commands
14-110 Configuring the VPN
Sample Output
The following output displays when a master key is generated:
XSR(config)#crypto key master generate
New key is 8573 4583 3994 2ff5
183b 4bdf fe92 dbc1
1132 ffe0 f8d9 3759
A script displays when a master key is specified, prompting you for the following information:
XSR(config)#crypto key master specify
Specify first encryption key in hex digits: []: 8573 4583 3994 2ff5
Specify second encryption key in hex digits: []: 183b 4bdf fe92 dbc1
Specify third encryption key in hex digits: []: 1132 ffe0 f9d9 3759
Are you sure? [y]:
Crypto Map Mode Commands
crypto map (Global IPSec)
This command creates or modifies a crypto map entry. It also acquires Crypto Map mode. Along
with the setting of a transform‐set, this constitutes IPSec Phase 2 configuration.
In Crypto Map mode, the following sub‐commands are available:
•
match address
‐ Correlates ACLs to map. Refer to
•
mode
‐ Selects encapsulation type ‐ tunnel or transport‐ for a transform‐set. Refer to
•
set peer
‐ Specifies peer’s IP address. Refer to
for the command definition.
•
set security-association level per-host
‐ Specifies separate SAs be requested for each
source/destination host pair. Refer to
•
set transform-set
‐ Correlates transform‐sets with map. Refer to
for the
command definition.
Crypto Map
Crypto maps provide two functions: filter and classify traffic to be protected as well as define the
policy to be applied to that traffic. The first use affects the flow of traffic on an interface; the second
affects the negotiation performed (via IKE) on behalf of that traffic.
IPSec crypto maps link definitions of the following:
•
Which traffic should be protected.
•
Which IPSec peers the protected traffic can be forwarded to ‐ these are the peers with which a
Security Association (SA) can be built.
•
Which transform‐sets are acceptable for use with the protected traffic.
•
How keys and SAs should be used or managed.
Note: A crypto map has no effect until it is attached to an interface.