Enterasys Networks X-Pedition XSR CLI - Manual (Page 565)

Crypto Map Mode Commands
XSR CLI Reference Guide 14-111
Crypto Map Rules
A crypto map is a collection of rules, each with a different seq‐num but the same map‐name. So, for
a given interface, you can have certain traffic forwarded to one IPSec peer with specified security
applied to that traffic, and other traffic forwarded to the same or a different IPSec peer with
different IPSec security applied. To accomplish this you create two crypto maps, each with the
same map‐name, but each with a different seq‐num. Crypto map rules are searched in order of seq‐
num. Sequence numbers, in addition to determining the order in which traffic is tested against the
rules, are used as an anti‐replay device to reject duplicate and old packets and so prevent an
intruder from copying a conversation and using it to work out encryption algorithms.
Syntax
crypto map map-name seq-num [ipsec-isakmp]
Syntax of the “no” Form
To delete a crypto map entry, use the no form of this command:
no crypto map map-name [seq-num]
Mode
Global configuration: XSR(config)#
Next Mode
Crypto Map configuration: XSR(config-crypto-m)#
Sample Output
The following example creates the crypto map ACMEmap:
XSR(config)#crypto map ACMEmap 7
XSR(config-crypto-m)#set transform-set esp-3des-sha
XSR(config-crypto-m)#match address 120
match address
This command specifies an access control list (ACL) for a crypto map entry. An ACL is applied
bidirectionally by IPSec and the XSR considers its “source” as the local address and its “destination”
as the remote address so typically only one match address and ACL is needed to define traffic with
a peer.
Syntax
match address [access-list-id]
map-name Crypto map identification. This is the name assigned when the crypto
map was created.
seq-num 32‐bit digit you assign to the crypto map. Range: 1 to 4096.
ipsec-isakmp This value provides backward compatibility with the industry‐standard
CLI. It is not mandatory.