Cisco 1801, Configuration Manual

Page: 92 / 198

7-6
Cisco 1800 Series Integrated Services Routers (Fixed) Software Configuration Guide
OL-6426-02
Chapter 7 Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation
Configure a VPN
Configure IPSec Transforms and Protocols
A transform set represents a certain combination of security protocols and algorithms. During IKE
negotiation, the peers agree to use a particular transform set for protecting data flow.
During IKE negotiations, the peers search in multiple transform sets for a transform that is the same at
both peers. When such a transform set is found, it is selected and applied to the protected traffic as a part
of both peers’ configurations.
Perform these steps to specify the IPSec transform set and protocols, beginning in global configuration
mode:
Step 3
aaa authorization { network | exec | commands
level | reverse-access | configuration } { default |
list-name } [ method1 [ method2... ]]
Example:
Router(config)# aaa authorization network
rtr-remote local
Router(config)#
Specifies AAA authorization of all
network-related service requests, including PPP,
and the method used to do so.
This example uses a local authorization database.
You could also use a RADIUS server for this. See
the
Cisco IOS Security Configuration Guide and
the Cisco IOS Security Command Reference for
details.
Step 4 username name { nopassword | password
password | password encryption-type
encrypted-password }
Example:
Router(config)# username Cisco password 0
Cisco
Router(config)#
Establishes a username-based authentication
system.
This example implements a username of Cisco
with an encrypted password of Cisco .
Command or Action Purpose
Command or Action Purpose
Step 1
crypto ipsec transform-set transform-set-name
transform1 [ transform2 ] [ transform3 ]
[ transform4 ]
Example:
Router(config)# crypto ipsec transform-set
vpn1 esp-3des esp-sha-hmac
Router(config)#
Defines a transform set—An acceptable
combination of IPSec security protocols and
algorithms.
See the Cisco IOS Security Command Reference
for detail about the valid transforms and
combinations.
Step 2
crypto ipsec security-association lifetime
{ seconds seconds | kilobytes kilobytes }
Example:
Router(config)# crypto ipsec
security-association lifetime seconds 86400
Router(config)#
Specifies global lifetime values used when
negotiating IPSec security associations.
See the Cisco IOS Security Command Reference
for details.