Filter
Top Products
13-8
Cisco 819 Integrated Services Routers Software Configuration Guide
OL-23590-02
Chapter 13 Configuring a VPN Using Easy VPN and an IPSec Tunnel
Configuration Tasks
Configure IPSec Transforms and Protocols
A transform set represents a certain combination of security protocols and algorithms. During IKE
negotiation, the peers agree to use a particular transform set for protecting data flow.
During IKE negotiations, the peers search in multiple transform sets for a transform that is the same at
both peers. When such a transform set is found, it is selected and applied to the protected traffic as a part
of both peers’ configurations.
Perform these steps to specify the IPSec transform set and protocols, beginning in global configuration
mode:
SUMMARY STEPS
1. crypto ipsec transform-set transform-set-name transform1 [transform2] [transform3]
[transform4]
2. crypto ipsec security-association lifetime {seconds seconds | kilobytes kilobytes}
DETAILED STEPS
Note With manually established security associations, there is no negotiation with the peer, and both sides
must specify the same transform set.
Configure the IPSec Crypto Method and Parameters
A dynamic crypto map policy processes negotiation requests for new security associations from remote
IPSec peers, even if the router does not know all the crypto map parameters (for example, IP address).
Perform these steps to configure the IPSec crypto method, beginning in global configuration mode:
Command or Action Purpose
Step 1
crypto ipsec transform-set
transform-set-name transform1 [transform2]
[transform3] [transform4]
Example:
Router(config)# crypto ipsec transform-set
vpn1 esp-3des esp-sha-hmac
Router(config)#
Defines a transform set—an acceptable
combination of IPSec security protocols and
algorithms.
See Cisco IOS Security Command Reference for
details about the valid transforms and
combinations.
Step 2
crypto ipsec security-association lifetime
{seconds seconds | kilobytes kilobytes}
Example:
Router(config)# crypto ipsec
security-association lifetime seconds 86400
Router(config)#
Specifies global lifetime values used when IPSec
security associations are negotiated.
See Cisco IOS Security Command Reference for
details.