Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1584 / 2164

1-34
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring IPsec and ISAKMP
Configuring IPsec
c.
Specify which IKEv1 transform sets or IKEv2 proposals are allowed for this crypto map. List
multiple transform sets or proposals in order of priority (highest priority first). You can specify up
to 11 transform sets or proposals in a crypto map using either of these two commands:
crypto map map-name seq-num set ikev1 transform-set transform-set-name1
[transform-set-name2 , … transform-set-name11 ]
crypto map map-name seq-num set ikev2 ipsec-proposal proposal-name1
[ proposal-name2, … proposal-name11 ]
Proposal-name1 and proposal-name11 specifies one or more names of the IPsec proposals for
IKEv2. Each crypto map entry supports up to 11 proposals.
For example (for IKEv1):
crypto map mymap 10 set ikev1 transform-set myset1 myset2
In this example, when traffic matches access list 101, the SA can use either myset1 (first priority)
or myset2 (second priority) depending on which transform set matches the transform set of the peer.
d.
(Optional) Specify an SA lifetime for the crypto map if you want to override the global lifetime.
crypto map
map-name seq-num
set security-association lifetime
{
seconds
seconds |
kilobytes kilobytes}
Map-name specifies the name of the crypto map set. Seq-num specifies the number you assign to the
crypto map entry.
For example:
crypto map mymap 10 set security-association lifetime seconds 2700
This example shortens the timed lifetime for the crypto map mymap 10 to 2700 seconds
(45 minutes). The traffic volume lifetime is not changed.
e.
(Optional) Specify that IPsec require perfect forward secrecy when requesting new SA for this
crypto map, or require PFS in requests received from the peer:
crypto map map-name seq-num set pfs [ group1 | group2 | group5 ]
For example:
crypto map mymap 10 set pfs group2
This example requires PFS when negotiating a new SA for the crypto map mymap 10. The ASA uses
the 1024-bit Diffie-Hellman prime modulus group in the new SA.
Step 5
Apply a crypto map set to an interface for evaluating IPsec traffic:
crypto map map-name interface interface-name
Map-name specifies the name of the crypto map set. Interface-name specifies the name of the interface
on which to enable or disable ISAKMP IKEv1 negotiation.
For example:
crypto map mymap interface outside
In this example, the ASA evaluates the traffic going through the outside interface against the crypto map
mymap to determine whether it needs to be protected.