Cisco 7100 Series Especificaciones descargar pdf (Pagina 57)

Intranet VPN Business Scenario 3-27

Configuring Crypto Maps

When two peers try to establish a SA, they must each have at least one crypto map entry

that is compatible with one of the other peer’s crypto map entries. For two crypto map

entries to be compatible, they must at least meet the following criteria:

• The crypto map entries must contain compatible crypto access lists (for example,mirror

imageaccess lists). In the case wherethe responding peer is using dynamiccrypto maps,

the entries in the local crypto access list must be “permitted” by the peer’scrypto access

list.

• The crypto map entries must each identify the other peer (unless the responding peer is

using dynamic crypto maps).

• The crypto map entries must have at least one transform set in common.

When IKE is used to establish SAs, the IPSec peers can negotiate the settings they will use

for the new SAs. This means that you can specify lists (such as lists of acceptable

transforms) within the crypto map entry.

After you have completed conﬁguring IPSec at each participating IPSec peer, conﬁgure

crypto map entries and apply the crypto maps to interfaces. This section contains basic

steps to conﬁgure crypto maps and includes the following tasks:

1 Creating Crypto Map Entries

2 Verifying Crypto Map Entries

3 Applying Crypto Maps to Interfaces

4 Verifying Crypto Map Interface Associations

1 2 ... 52 53 54 55 56 57 58 59 60 61 62 ... 111 112

Sin comentarios

Cisco 7100 Series Especificaciones Pagina 57