Thanks for getting back harbor.....
nice response ! I read this on the Cisco website. But what I still don't get is whether or not I need the "encryption 3des" configuration line under the crypto policy....
eg crypto isakmp policy 10
hash md5
<encr 3des>
authentication pre-share
I understand how the crypto map calls upon the various bits and pieces (sorry probably should have made this clear at the outset) but when I have implemented these VPNs previously I have included the <encr 3des> line as above. Does the fact that the transform set esp-3des is defined mean that the traffic will be encrypted using 3des ??????
Nearly there for the points though !!!!! :-)
Main Topics
Browse All Topics
by: harbor235Posted on 2005-12-21 at 07:46:35ID: 15527100
>but my question is whether or not the traffic will be encrypted using 3DES simply by calling upon a transform set ?
There should be a crypto map statement referencing the transform set, something like this (from Cisco website):
Crypto map entries created for IPSec pull together the various parts used to set up IPSec SAs, including:
•Which traffic should be protected by IPSec (per a crypto access list)
•The granularity of the flow to be protected by a set of SAs
•Where IPSec-protected traffic should be sent (who the remote IPSec peer is)
•The local address to be used for the IPSec traffic (See the section " Applying Crypto Map Sets to Interfaces" for more details.)
•What IPSec SA should be applied to this traffic (selecting from a list of one or more transform sets)
•Whether SAs are manually established or are established via IKE
•Other parameters that might be necessary to define an IPSec SA
How Crypto Maps Work
Crypto map entries with the same crypto map name (but different map sequence numbers) are grouped into a crypto map set. Later, you will apply these crypto map sets to interfaces; then, all IP traffic passing through the interface is evaluated against the applied crypto map set. If a crypto map entry sees outbound IP traffic that should be protected and the crypto map specifies the use of IKE, a SA is negotiated with the remote peer according to the parameters included in the crypto map entry; otherwise, if the crypto map entry specifies the use of manual SAs, an SA should have already been established via configuration. (If a dynamic crypto map entry sees outbound traffic that should be protected and no security association exists, the packet is dropped.)
The policy described in the crypto map entries is used during the negotiation of SAs. If the local router initiates the negotiation, it will use the policy specified in the static crypto map entries to create the offer to be sent to the specified IPSec peer. If the IPSec peer initiates the negotiation, the local router will check the policy from the static crypto map entries, as well as any referenced dynamic crypto map entries to decide whether to accept or reject the peer's request (offer).
For IPSec to succeed between two IPSec peers, both peers' crypto map entries must contain compatible configuration statements.
Here is a good starting point:
http://vpn.shmoo.com/vpn/v
harbor235 ;}