Cisco 7100 Series Especificaciones descargar pdf (Pagina 84)

Step 2—Configuring Encryption and an IPSec Tunnel

Cisco 7100 Series VPN Configuration Guide

4-12

5 Deﬁning Transform Sets and Conﬁguring IPSec Tunnel Mode

6 Verifying Transform Sets and IPSec Tunnel Mode

Note IKE uses User Datagram Protocol (UDP) port 500. The IPSec encapsulating

security payload (ESP) and authentication header (AH) protocols use IP protocol numbers

50 and 51. Ensure that your access lists are conﬁgured so that IP protocol 50, 51, and UDP

port 500 trafﬁc is not blocked at interfaces used by IPSec. In some cases, you might need

to add a statement to your access lists to explicitly permit this trafﬁc.

Creating Crypto Access Lists

Crypto access lists are used to deﬁne which IP trafﬁcwill beprotected by crypto and which

trafﬁc will not beprotected bycrypto. (These accesslists arenot the sameas regular access

lists, which determine what trafﬁc to forward or block at an interface.) For example, you

can create access lists to protect all IP trafﬁc between the headquarters router and business

partner router.

The access lists themselves are not speciﬁc to IPSec. It is the crypto map entry referencing

the speciﬁc access list that deﬁnes whether IPSec processing is applied to the trafﬁc

matching a permit in the access list.

To create crypto a access list, enter the following command in global conﬁguration mode:

Command Purpose

hq-sanjose(config)# access-list 111 permit

ip host 10.2.2.2 host 10.1.5.3

Specify conditions to determine which IP packets are

protected.

(Enable or disable crypto for trafﬁc that

matches these conditions.) This example conﬁgures

access list 111 to encrypt all IP trafﬁc between the

headquarters Web server (translated inside global IP

address 10.2.2.2) and PC B (IP address 10.1.5.3) in the

business partner ofﬁce.

We recommend that you conﬁgure “mirror image” crypto

access lists for use by IPSec and that you avoid using the

any keyword.

1 You specify conditions using an IP access list designated by either a number or a name. The access-list command designates a

numbered extended access list; the ip access-list extended command designates a named access list.

1 2 ... 79 80 81 82 83 84 85 86 87 88 89 ... 111 112

Sin comentarios

Cisco 7100 Series Especificaciones Pagina 84