![background image](http://html.mh-extra.com/html/cisco/5505-asa-firewall-edition-bundle/5505-asa-firewall-edition-bundle_cli-configuration-manual_186241584.webp)
1-34
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring IPsec and ISAKMP
Configuring IPsec
c.
Specify which IKEv1 transform sets or IKEv2 proposals are allowed for this crypto map. List
multiple transform sets or proposals in order of priority (highest priority first). You can specify up
to 11 transform sets or proposals in a crypto map using either of these two commands:
crypto map
map-name seq-num
set ikev1 transform-set
transform-set-name1
[transform-set-name2
, …
transform-set-name11
]
crypto
map
map-name
seq-num
set ikev2 ipsec-proposal
proposal-name1
[
proposal-name2,
…
proposal-name11
]
Proposal-name1
and
proposal-name11
specifies one or more names of the IPsec proposals for
IKEv2. Each crypto map entry supports up to 11 proposals.
For example (for IKEv1):
crypto map mymap 10 set ikev1 transform-set myset1 myset2
In this example, when traffic matches access list 101, the SA can use either myset1 (first priority)
or myset2 (second priority) depending on which transform set matches the transform set of the peer.
d.
(Optional) Specify an SA lifetime for the crypto map if you want to override the global lifetime.
crypto map
map-name seq-num
set security-association lifetime
{
seconds
seconds |
kilobytes
kilobytes}
Map-name
specifies the name of the crypto map set.
Seq-num
specifies the number you assign to the
crypto map entry.
For example:
crypto map mymap 10 set security-association lifetime seconds 2700
This example shortens the timed lifetime for the crypto map mymap 10 to 2700 seconds
(45 minutes). The traffic volume lifetime is not changed.
e.
(Optional) Specify that IPsec require perfect forward secrecy when requesting new SA for this
crypto map, or require PFS in requests received from the peer:
crypto map map-name
seq-num
set pfs
[
group1
|
group2
|
group5
]
For example:
crypto map mymap 10 set pfs group2
This example requires PFS when negotiating a new SA for the crypto map mymap 10. The ASA uses
the 1024-bit Diffie-Hellman prime modulus group in the new SA.
Step 5
Apply a crypto map set to an interface for evaluating IPsec traffic:
crypto map
map-name
interface
interface-name
Map-name
specifies the name of the crypto map set.
Interface-name
specifies the name of the interface
on which to enable or disable ISAKMP IKEv1 negotiation.
For example:
crypto map mymap interface outside
In this example, the ASA evaluates the traffic going through the outside interface against the crypto map
mymap to determine whether it needs to be protected.
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......