Cisco 7100 Series Especificaciones descargar pdf (Pagina 56)

Step 3—Configuring Encryption

Cisco 7100 Series VPN Configuration Guide

3-26

Conﬁguring Crypto Maps

Crypto map entries created for IPSec pull together the various parts used to set up IPSec

SAs, including:

• Which trafﬁc should be protected by IPSec (per a crypto access list).

• The granularity of the ﬂow to be protected by a set of SAs.

• Where IPSec-protected trafﬁc should be sent (who the remote IPSec peer is).

• The local address to be used for the IPSec trafﬁc. (See the “Applying Crypto Maps to

Interfaces” section on page 3-30 for more details.)

• What IPSec security should be applied to this trafﬁc(selecting from a list of one or more

transform sets).

• Whether SAs are manually established or are established via IKE.

• Other parameters that might be necessary to deﬁne an IPSec SA.

Crypto map entries with the same crypto map name (but different map sequence numbers)

are grouped into a crypto map set. Later, you willapply these crypto map sets to interfaces;

then, all IP trafﬁc passing through the interface is evaluated against the applied crypto map

set. If a crypto map entry sees outbound IP trafﬁc that should be protected and the crypto

map speciﬁes the use of IKE, a security association is negotiated with the remote peer

according to the parameters included in the crypto map entry; otherwise, if the crypto map

entry speciﬁes the use of manual security associations, a security association should have

already been established via conﬁguration. (If a dynamic crypto map entry sees outbound

trafﬁc that should be protected and no security association exists, the packet is dropped.)

The policy described in the crypto map entries is used during the negotiation of security

associations. If the local router initiates the negotiation, it will use the policy speciﬁed in

the static crypto map entries to create the offer to be sent to the speciﬁed IPSec peer. If the

IPSec peer initiates the negotiation, the local router will check the policy from the static

crypto map entries, as well as any referenced dynamic crypto map entries to decide whether

to accept or reject the peer’s request (offer).

ForIPSec to succeed between twoIPSec peers, both peers’ crypto map entries must contain

compatible conﬁguration statements.

1 2 ... 51 52 53 54 55 56 57 58 59 60 61 ... 111 112

Sin comentarios

Cisco 7100 Series Especificaciones Pagina 56