4-5
Cisco 7401ASR Installation and Configuration Guide
OL-5419-01 B0
Chapter 4 Configuring the VPN Acceleration Module
Configuration Tasks
Creating Crypto Map Entries
To create crypto map entries that use IKE to establish the security associations, use the following
commands, starting in global configuration mode:
ah-sha-hmac
AH with SHA
(HMAC variant)
authentication
algorithm
esp-des
ESP with 56-bit DES
encryption algorithm
esp-sha-hmac
ESP with SHA
(HMAC variant)
authentication
algorithm
esp-null
ESP transform without
cipher
1.
Pick one transform option.
2.
Pick one transform option, but only if you selected esp-null or ESP encrypting transform.
Table 4-1
Allowed Transform Combinations (continued)
AH Transform
1
ESP Encryption Transform
1
ESP Authentication Transform
2
Command
Purpose
Step 1
crypto map map-name seq-num
ipsec-isakmp
Creates the crypto map and enters crypto map
configuration mode.
Step 2
match address access-list-id
Specifies an extended access list. This access
list determines which traffic is protected by
IPSec and which is not.
Step 3
set peer {hostname | ip-address}
Specifies a remote IPSec peer. This is the peer
to which IPSec-protected traffic can be
forwarded.
Repeat for multiple remote peers.
Step 4
set transform-set transform-set-name1
[transform-set-name2...transform-set-na
me6]
Specifies which transform sets are allowed for
this crypto map entry. Lists multiple transform
sets in order of priority (highest priority first).
Step 5
end
Exits crypto map configuration mode.
Step 6
Repeat these steps to create additional crypto map entries as required.
