Cisco 7100 Series Spezifikationen PDF herunterladen (Seite 52)

Step 3—Configuring Encryption

Cisco 7100 Series VPN Configuration Guide

3-22

Deﬁning Transform Sets

A transform set represents a certain combination of security protocols and algorithms.

During the IPSec SA negotiation, the peers agree to use a particular transform set for

protecting a particular data ﬂow.

You can specify multiple transform sets, and then specify one or more of these transform

sets in a crypto map entry. The transform set deﬁned in the crypto map entry will be used

in the IPSec SA negotiation to protect the data ﬂows speciﬁed by that crypto map entry’s

access list.

DuringIPSec SA negotiations withIKE, the peers search for a transform set that is thesame

at both peers. When such a transform set is found, it is selected and is applied to the

protected trafﬁc as part of both peers’ IPSec SAs.

With manually established SAs, there is no negotiation with the peer, so both sides must

specify the same transform set.

If you change a transform set deﬁnition, the change is only applied to crypto map entries

that reference the transform set. The change will not be applied to existing SAs, but will be

used in subsequent negotiations to establish new SAs.

To deﬁne a transform set, complete the following steps starting in global conﬁguration

mode:

Step Command Purpose

hq-sanjose(config)# crypto ipsec

transform-set proposal1 ah-sha-hmac

esp-des esp-sha-hmac

Deﬁne a transform set and enter crypto-transform

conﬁguration mode. This example combines AH

transform ah-sha-hmac, ESP

encryption transform

esp-des, and ESP

authentication transform

esp-sha-hmac in the transform set proposal1.

There are complex rules deﬁning which entries you

can use for the transform arguments. These rules are

explained in the command description for the crypto

ipsec transform-set command. You can also use the

crypto ipsec transform-set? command, in global

conﬁguration mode, to view the available transform

arguments.

1 2 ... 47 48 49 50 51 52 53 54 55 56 57 ... 111 112

Keine Kommentare

Cisco 7100 Series Spezifikationen Seite 52