Motorola 2.1 Installation Guide Page 465

  • Download
  • Add to my manuals
  • Print
  • Page
    / 952
  • Table of contents
  • BOOKMARKS
  • Rated. / 5. Based on customer reviews
Page view 464
PROFILES 7 - 27
7.1.11 crypto
Creating Profiles
Use crypto to define system level local ID for ISAKMP negotiation and to enter the ISAKMP Policy, ISAKMP Client or
ISAKMP Peer command set.
A crypto map entry is a single policy that describes how certain traffic is secured. There are two types of crypto map
entries: ipsec-manual and ipsec-ike entries. Each entry is given an index (used to sort the ordered list).
When a non-secured packet arrives on an interface, the crypto map set associated with that interface is processed (in
order). If a crypto map entry matches the non-secured traffic, the traffic is discarded.
When a packet is transmitted on an interface, the crypto map set associated with that interface is processed. The first
crypto map entry that matches the packet is used to secure the packet. If a suitable SA exists, it is used for transmission.
Otherwise, IKE is used to establish an SA with the peer. If no SA exists (and the crypto map entry is “respond only”), the
packet is discarded.
When a secured packet arrives on an interface, its SPI is used to look up a SA. If a SA does not exist (or if the packet fails
any of the security checks), it is discarded. If all checks pass, the packet is forwarded normally.
Supported in the following platforms:
RFS7000
RFS6000
RFS4000
AP71xx
AP650
AP6511
AP6532
Syntax
crypto [ipsec|isakmp|map|pki]
crypto ipsec [security-association|transform-set]
crypto ipsec security-association lifetime [kilobyte|seconds] <lifetime>
crypto ipsec transform-set <transform-set-tag> [ah-md5-hmac|
ah-sha-hmac|esp-3des|esp-aes|esp-aes-192|esp-aes-256|esp-des|
esp-md5-hmac|esp-sha-hmac]
crypto isakmp [aggresive-mode-peer|client|keepalive|key|policy]
crypto isakmp client configuration group default
crypto isakmp keepalive <10-3600>
crypto isakmp key [0 <WORD>|2 <WORD>|<WORD>] address <A.B.C.D>
[address <IP>|hostname <HOST>]
crypto isakmp aggresive-mode-peer [address <IP>|dn <distinguished-name>|hostname
<HOST>] key [0 <WORD>|2 <WORD>|<WORD>]
crypto isakmp policy <ISAKMP-POLICY>
crypto map <crypto-map-tag> <1-1000> [ipsec-isakmp|ipsec-manual] {dynamic}
crypto pki import crl <WORD> URL <1-168>
Page view 464
1 2 ... 460 461 462 463 464 465 466 467 468 469 470 ... 951 952

Comments to this Manuals

No comments