Crypto map

Hi all, when doing an access list for encrypting traffic on a crypto map, what kind of access list do you use, and do you permit destination traffic to be encrypted or source ?

Carl,
Extended ACLs are used to define interesting traffic which needs to be encrypted.
access-list 101
hope this helps ...

Similar Messages

  • Multiple Crypto Maps on Single Outside Interface

    Hi, I had the following crypto map configured on my ASA5505 to allow Cisco IPSec VPN clients to connect from the outside:
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    I'm trying now to set up an additional crypto map - a static configuration to establish a tunnel with Windows Azure services. The configuration they gave me is:
    crypto map azure-crypto-map 10 match address azure-vpn-acl
    crypto map azure-crypto-map 10 set peer XXX.XXX.XXX.XXX (obfuscated)
    crypto map azure-crypto-map 10 set transform-set azure-ipsec-proposal-set
    crypto map azure-crypto-map interface outside
    However, when I apply that configuration, my Cisco IPSec clients can no longer connect. I believe my problem is that last line:
    crypto map azure-crypto-map interface outside
    which blows away my original line:
    crypto map outside_map interface outside
    It seems I'm stuck with picking just one of the maps to apply to the outside interface. Is there a way to apply both of these maps to the outside interface to allow both IPSec tunnels to be created? We're running ASA version 8.4(7)3.

    Hi,
    You can use the same "crypto map"
    Just add
    crypto map outside_map 10 match address azure-vpn-acl
    crypto map outside_map 10 set peer XXX.XXX.XXX.XXX (obfuscated)
    crypto map outside_map 10 set transform-set azure-ipsec-proposal-set
    Your dynamic VPN Clients will continue to work just fine as their "crypto map" statements are with the lowest priority/order in the "crypto map" configurations (65535) and the L2L VPN is higher (10)
    And what I mean with the above is that when a L2L VPN connections is formed from the remote end it will naturally match the L2L VPN configurations you have with "crypto map" configurations using the number "10". Then when a VPN Client connects it will naturally not match the number "10" specific configurations and will move to the next entry and will match it (65535)
    If you would happen to configure a new L2L VPN connection then you could give it the number "11" for example and everything would still be fine.
    Hope this helps
    - Jouni

  • Which interface does "crypto map vpn" get assigned to?

    I'm setting up a site to site vpn and have been reading some examples, but my 871 uses a vlan so it confuses me a bit. Do I assign the statement crypto map vpn to the vlan1 interface or fe4 which is my WAN side.

    Sander
    If we knew more about your environment we might be able to give better answers. In general the crypto map is assigned to the outbound layer 3 interface. But I can not tell from your description whether fe4 or VLAN 1 is the outbound layer 3 interface. Does fe4 have an IP configured on it? If so then perhaps it is the outbound layer 3 interface and gets the crypto map. Or perhaps VLAN 1 is the outbound layer 3 interface and gets the crypto map.
    If this helps you figure it out that is good. Otherwise perhaps you can provide some clarification of the environment.
    HTH
    Rick
    Sent from Cisco Technical Support iPhone App

  • Site to Site VPN working without Crypto Map (ASA 8.2(1))

    Hi All,
    Found a strange situation on our ASA5540 firewall :
    We have couple Site to Site VPNs and also enable cleint VPN on the ASA, all are working fine. But found a Site to Site VPN is up and running without crypto map configuration. Is it possible ?
    I tried to clear isa sa and clear ipsec sa then the VPN came up again. Also tested it's pingable to remote site thru the VPN.
    I did see there is tunnel-group config for the VPN but didn't see any crypto map and ACL.
    How does Firewall know which traffic need be encrypted to this VPN tunnel without crypto map?
    Is it the bug ?
    Thanks in advance,

    It might be an easy vpn setup.
    Could you post a running config output remove any sensitive info.  This could help us answer your question more exactly.

  • [ERR]crypto map WARNING: This crypto map is incomplete

    i have PIX 501 ver6.3(5) when i setup VPN i get this error message
    WARNING:This crypto map is incomplete to remedy the situation add a peer and a valid access-list to this crypto map.
    although it seems fine in sh conf command
    but tunnel is not started
    when i review log i found
    sa_request,ISAKMP Phase 1 exchange started

    i could successfully establish VPN with another FW cisco 501 6.3
    but still can't fix my dilemma which i connect to Huawei Eudemon 500‎
    sh isakmp
    PIX Version 6.3(5)‎
    interface ethernet0 10full
    interface ethernet1 100full
    nameif ethernet0 outside security0‎
    nameif ethernet1 inside security100 ‎
    access-list inside_outbound_nat0_acl permit ip host internal IP host name remote internal IP1‎
    access-list inside_outbound_nat0_acl permit ip host internal IP host name remote internal IP2‎
    access-list outside_cryptomap_100 permit ip host internal IP host remote internal IP1‎
    access-list outside_cryptomap_100 permit ip host internal IP host remote internal IP2 ‎
    global (outside) 1 interface‎
    nat (inside) 0 access-list inside_outbound_nat0_acl
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac ‎
    crypto ipsec security-association lifetime seconds 3600‎
    crypto map outside_map 100 ipsec-isakmp
    crypto map outside_map 100 match address outside_cryptomap_100‎
    crypto map outside_map 100 set peer remote peer
    crypto map outside_map 100 set transform-set ESP-3DES-SHA
    crypto map outside_map 100 set security-association lifetime seconds 3600 kilobytes 1843200‎
    crypto map outside_map interface outside
    isakmp enable outside
    ‎ ‎
    isakmp key ******** address remote peer netmask 255.255.255.255 no-xauth no-config-mode ‎
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption 3des
    isakmp policy 20 hash sha‎
    isakmp policy 20 group 2‎
    isakmp policy 20 lifetime 86400‎
    sh crypto map
    Crypto Map: "outside_map" interfaces: { outside }‎
    Crypto Map "outside_map" 100 ipsec-isakmp
    Peer = remote peer
    access-list outside_cryptomap_100; 2 elements‎
    access-list outside_cryptomap_100 line 1 permit ip host 10.102.0.11 host remote internal IP1 ‎‎(hitcnt=14) ‎
    access-list outside_cryptomap_100 line 2 permit ip host 10.102.0.11 host remote internal IP2 ‎‎(hitcnt=6) ‎
    Current peer: remote peer
    Security association lifetime: 1843200 kilobytes/3600 seconds‎
    PFS (Y/N): N
    Transform sets={ ESP-3DES-SHA, }‎
    Crypto Map: "set" interfaces: { }‎

  • Crypto Map on Loopback interface or Physical Interface

    Dear All,
    When we try to apply the crypto map on any physical interface or the loopback interface on WS-6506-E, it is showing the error. But the same i could apply on VLAN interface. Can anyone explain me what is the issue..?
    6506(config)#interface loopback 3
    6506(config-if)#crypto map XXXX
    ERROR: Crypto Map configuration is not supported on the given interface
    Any hardware limitation?

    This was proven to break CEF in the past and is a bad design choice by default.
    Newer release do not allow you to configure this.
    If you're curious if it will work for you check releases prior to 15.x.
    M.

  • I am not able to remove crypto map SONZOGNI^@

    Please,show me the command to remove crypto map SONZOGNI^@ .
    Command "no crypto map SONZOGNI^@" doesn't work,the response is crypto map unexisting.
    The Router model is 3640.
    Thanks
    12.0
    service timestamps debug datetime localtime show-timezone
    service timestamps log datetime localtime show-timezone
    service password-encryption
    boot system flash:c3640-is40-mz.120-24.bin
    logging buffered 32000 debugging
    no logging console
    ip subnet-zero
    no ip source-route
    no ip finger
    no ip domain-lookup
    isdn switch-type primary-net5
    crypto map SONZOGNI^@ 1
    set peer cisco-sonzogni
    match address sonzogni-encrypt
    clock timezone CET 1
    clock summer-time CET-SUM recurring last Sun Mar 3:00 last Sun Oct 3:00
    call-history-mib max-size 200

    Try no crypto map SONZOGNI^@" 1, you have to mention the 1 also.

  • Crypto map mymap command I am not familiar with

    I have the following commands in a new pix I am taking over and I am not sure what they do?
    crypto map mymap client configuration address initiate
    crypto map mymap client configuration address respond
    any help would be appreciated

    Hi .. they are used for remote VPNs:
    1.- crypto map mymap client configuration address initiate
    explanation: Use the crypto map mymap for remote vpn clients and the PIX Firewall will attempt to set IP addresses for each client.
    2.- crypto map mymap client configuration address respond
    explanation: Use the crypto map mymap for remote vpn clients and the PIX Firewall will accept requests for IP addresses from any
    requesting client.
    I hope it helps .. please rate if it does !!

  • Crypto maps

    Here our provider links all our sites via point to point crypto maps on a wes circuit, will all these point to point maps be on there own /30 masks, how are these set up with regards to addressing etc ?

    Hi Carl,
    As far as crypto maps are concerned, the peer address configured in the crypto map should be reachable. It doesn't matter that it needs.
    Mostly the peers are located far away from each other, with ip connectivity between them.
    -VJ

  • Crypto map on PIX versus router

    Hi all,
    i am looking for eqvivalent of IOS command:
    crypto map xxx local-address Loopback0
    Is it possible to link crypto map with other IP address as real interface address on PIX?
    Thank you in advance.

    Hi Rick,
    now we have two gateways in our company. One is used for VPN traffic, x.x.x.254 and second is used for normal traffic.
    Now we want to unified these gateways to one PIX ... and i am looking for simplest way.
    For us, the simplest way is to use crypto map on PIX with IP address x.x.x.254 but with ip address of physical interface x.x.x.y.
    Now i know, that it is not possible to do it on PIX ... so i am looking for another solutions.
    Problem is, that we have our bussines partners, that know our actual IP ... and have firewalls opened for that IP :)
    I think that best solution will be NATing traffic to these customers to old IP.
    Thanks for your info.

  • Crypto Map on Tunnel interface

    hi guys, when i trying to apply crypto map on tunnel interface , debug is (
    crypto map is configured on tunnel interface.  Currently only GDOI crypto map is supported on tunnel interface )
    why i can't apply simple crypto map on tunnel interface? anyone knows?
    thanks

    This was proven to break CEF in the past and is a bad design choice by default.
    Newer release do not allow you to configure this.
    If you're curious if it will work for you check releases prior to 15.x.
    M.

  • Cisco 5520: removed crypto map still in effect

    so i typoed a command: "crypto map Map1 7"... instead of "crypto map Map1 70".
    I cleared the Map1 7 entries, and added the correct entries in Map1 70.
    I cleared all of the vpn sessions:
    no crypto map Map1 int outside
    cl ips sa
    cl isa sa
    Now, however, whenever I try to ping the remote network from the inside interface, it seems to read the Map1 7 policy instead of Map1-70.
    Is there anyway to clear the Map1 7 entries from memory? I'm trying to avoid rebooting the firewall.
    Thanks,
    Jeff
    But when I try

    With ASA you need the "clear configure" command to remove a crypto map sequence number
    clear configure crypto map map-name seq-num
    (in configuration mode)

  • WARNING: This crypto map is incomplete

                    Hi ,
      i have ASA with 4 l2l vpn configured. as now am trying to configure new VPN tunnel; while configuring of crypto map set match add its giving me
    error like ... WARNING: This crypto map is incomplete
      as i have read all the discussion from forms its not effecting ; request you to please help
    Thanks
    Gajendra

    Hi,
    This is a normal message and just tells you that you have not yet entered all the "crypto map" commands related to this new connection to make the configuration complete
    You will essentially have to make sure that you have ATLEAST the following lines configured
    crypto map match address
    crypto map set peer
    crypto map set ikev1 transform-set
    The "transform-set" part might NOT need the "ikev1" depending on your ASAs software level.
    - Jouni

  • Can I enter crypto map command on an ethernet interface(LAN)

    Hi Friends,
    I am establishing VPN tunnel through Internet. I have the public address configured on Ethernet interface of router connecting the LAN. Can I bind the crypto map command to this inside interface and establish the VPN connectivity from this interface. Please help me providing the knowledge.

    your crypto map must be bound to outside interface.
    but you can chose which ip to use
    http://www.cisco.com/en/US/docs/ios/mwpdsn/command/reference/mwp_02.html#wp1014299
    [Pls RATE if HELPS]

  • Converting crypto map to unnumbered VTI

    I'm trying to convert a crypto map VPN to a ip unnumbered VTI. The crypto map has been working for months. The VTI... no so much. Here are the applicable config entries.
    ### original config
    crypto isakmp policy 30
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key xxxxxxxx address 10.1.1.10
    crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
    crypto map CRYPTO 50 ipsec-isakmp
    set peer 10.1.1.10
    set transform-set 3DES-SHA
    set pfs group2
    match address VPN1
    ip access-list extended VPN1
    permit ip host 172.16.16.10 host 10.5.5.1
    permit ip host 172.16.16.10 host 10.5.5.4
    I only removed the crypto map and added the following.
    ### New Config
    crypto ipsec profile V1
    set security-association lifetime seconds 28800
    set transform-set 3DES-SHA
    set pfs group2
    interface Tunnel0
    ip unnumbered FastEthernet0/0
    ip nat outside
    ip virtual-reassembly
    tunnel source 172.16.8.1
    tunnel destination 10.1.1.10
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile V1
    I keep getting this ISAKMP error now.
    ISAKMP:(0:54:HW:2):deleting SA reason "Recevied fatal informational" state (I) QM_IDLE (peer 10.1.1.10)
    Any help would be greatly appreciated. Also... I have no idea what is running on the other end (it's a partner network), but I suspect it's a crypto map on IOS.
    Thank you!

    Access-lists, FW (ZBF, CBAC) and all other features work on SVTI same way they would work on a physical or other logical interfaces (with very few exceptions). 

Maybe you are looking for