Enterasys X-Pedition XSR, Cli Reference Manual

Page: 564 / 684

Crypto Map Mode Commands
14-110 Configuring the VPN
Sample Output
The following output displays when a master key is generated:
XSR(config)#crypto key master generate
New key is 8573 4583 3994 2ff5
183b 4bdf fe92 dbc1
1132 ffe0 f8d9 3759
A script displays when a master key is specified, prompting you for the following information:
XSR(config)#crypto key master specify
Specify first encryption key in hex digits: []: 8573 4583 3994 2ff5
Specify second encryption key in hex digits: []: 183b 4bdf fe92 dbc1
Specify third encryption key in hex digits: []: 1132 ffe0 f9d9 3759
Are you sure? [y]:
Crypto Map Mode Commands
crypto map (Global IPSec)
This command creates or modifies a crypto map entry. It also acquires Crypto Map mode. Along
with the setting of a transform ‐ set, this constitutes IPSec Phase 2 configuration.
In Crypto Map mode, the following sub ‐ commands are available:
•
match address
‐ Correlates ACLs to map. Refer to page 14 ‐ 111 for the command definition.
•
mode
‐ Selects encapsulation type ‐ tunnel or transport ‐ for a transform ‐ set. Refer to
page 14 ‐ 112 for the command definition.
•
set peer
‐ Specifies peer’s IP address. Refer to page 14 ‐ 113 for the command definition.
•
set security-association level per-host
‐ Specifies separate SAs be requested for each
source/destination host pair. Refer to page 14 ‐ 114 for the command definition.
•
set transform-set
‐ Correlates transform ‐ sets with map. Refer to page 14 ‐ 114 for the
command definition.
Crypto Map
Crypto maps provide two functions: filter and classify traffic to be protected as well as define the
policy to be applied to that traffic. The first use affects the flow of traffic on an interface; the second
affects the negotiation performed (via IKE) on behalf of that traffic.
IPSec crypto maps link definitions of the following:
• Which traffic should be protected.
• Which IPSec peers the protected traffic can be forwarded to ‐ these are the peers with which a
Security Association (SA) can be built.
• Which transform ‐ sets are acceptable for use with the protected traffic.
• How keys and SAs should be used or managed.
Note: A crypto map has no effect until it is attached to an interface.