Support User Manuals

Enterasys Networks XSR CLI Router User Manual

Open as PDF

of 684

Crypto Map Mode Commands

14-110 Configuring the VPN

Sample Output

Thefollowingoutputdisplayswhenamasterkeyisgenerated:

XSR(config)#crypto key master generate

New key is 8573 4583 3994 2ff5

183b 4bdf fe92 dbc1

1132 ffe0 f8d9 3759

Ascriptdisplayswhenamasterkeyisspecified,promptingyouforthefollowinginformation:

XSR(config)#crypto key master specify

Specify first encryption key in hex digits: []: 8573 4583 3994 2ff5

Specify second encryption key in hex digits: []: 183b 4bdf fe92 dbc1

Specify third encryption key in hex digits: []: 1132 ffe0 f9d9 3759

Are you sure? [y]:

Crypto Map Mode Commands

crypto map (Global IPSec)

Thiscommandcreatesormodifiesacryptomapentry.ItalsoacquiresCryptoMapmode.Along

withthesettingofatransform‐set,thisconstitutesIPSecPhase2configuration.

InCryptoMapmode,thefollowingsub‐commandsareavailable:

•

match address ‐CorrelatesACLstomap.Refertopage14‐111forthecommanddefinition.

•

mode ‐Selectsencapsulationtype‐tunnelortransport‐foratransform‐set.Referto

page14‐112forthecommanddefinition.

•

set peer ‐Specifiespeer’sIPaddress.Refertopage14‐113forthecommanddefinition.

•

set security-association level per-host ‐SpecifiesseparateSAsberequestedforeach

source/destination hostpair.Refertopage14‐114forthecommanddefinition.

•

set transform-set ‐Correlatestransform‐setswithmap.Refertopage14‐114forthe

commanddefinition.

Crypto Map

Cryptomapsprovidetwofunctions:filterandclassifytraffictobeprotectedaswellasdefinethe

policytobeappliedtothattraffic.Thefirstuseaffectstheflowoftrafficonaninterface;thesecond

affectsthenegotiationperformed(viaIKE)onbehalfofthattraffic.

IPSeccryptomaps

linkdefinitionsofthefollowing:

•Whichtrafficshouldbeprotected.

•WhichIPSecpeerstheprotectedtrafficcanbeforwardedto‐thesearethepeerswithwhicha

SecurityAssociation(SA)canbebuilt.

•Whichtransform‐setsareacceptableforusewiththeprotectedtraffic.

•HowkeysandSAsshouldbeusedormanaged.

Note: A crypto map has no effect until it is attached to an interface.

previous next