Cisco 7600 Series Router SIP, SSC, and SPA Software Configuration Guide
Configuring Enhanced IPSec Features Using the IPSec VPN SPA
Downloads: This chapterpdf (PDF - 428.0KB) The complete bookPDF (PDF - 13.22MB) | Feedback

Configuring Enhanced IPSec Features Using the IPSec VPN SPA

Table Of Contents

Configuring Enhanced IPSec Features Using the IPSec VPN SPA

Overview of Enhanced IPSec Features

Configuring Advanced Encryption Standard in a Transform Set

Verifying the AES Transform Set

Configuring Reverse Route Injection

RRI Configuration Guidelines and Restrictions

Configuring RRI Under a Static Crypto Map

Configuring RRI Under a Dynamic Crypto Map

Configuring the IPSec Anti-Replay Window Size

Expanding the IPSec Anti-Replay Window Size Globally

Expanding the IPSec Anti-Replay Window at the Crypto Map Level

Verifying the IPSec Anti-Replay Window Size Configuration at the Crypto Map Level

Disabling the IPSec Anti-Replay Checking

Configuring an IPSec Preferred Peer

IPSec Preferred Peer Configuration Guidelines and Restrictions

Configuring a Default Peer

Configuring the IPSec Idle Timer with a Default Peer

Configuring IPSec Security Association Idle Timers

IPSec Security Association Idle Timer Configuration Guidelines

Configuring the IPSec SA Idle Timer Globally

Configuring the IPSec SA Idle Timer per Crypto Map

Configuring Distinguished Name-Based Crypto Maps

Distinguished Name-Based Crypto Map Configuration Guidelines and Restrictions

Configuring QoS on the SPA-IPSEC-2G IPSEC VPN SPA

QoS Configuration Guidelines and Restrictions

Configuring QoS on the WS-IPSEC-3 IPSEC VSPA

Using the Module QoS Features of the WS-IPSEC-3 IPSEC VSPA

Classifying, Marking, and Policing Traffic

Setting Priority

Shaping Traffic

Reserving Bandwidth

Setting the Queue Limit

Failover

Configuring Module QoS

Using the Carrier QoS Features of the SSC-600

Carrier QoS Configuration Guidelines and Restrictions

QoS Configuration Examples

Carrier QoS Configuration Example

Module QoS Configuration Example

Configuring Sequenced Crypto ACLs

Configuring Deny Policy Enhancements for Crypto ACLs

Deny Policy Enhancements for Crypto ACLs Configuration Guidelines and Restrictions

Configuration Examples

Advanced Encryption Standard Configuration Example

Reverse Route Injection Configuration Examples

RRI Under a Static Crypto Map Configuration Example

RRI Under a Dynamic Crypto Map Configuration Example

RRI with Existing ACLs Configuration Example

RRI for Two Routes Configuration Example

RRI Through a User-Defined Hop Configuration Example

IPSec Anti-Replay Window Size Configuration Examples

IPSec Anti-Replay Window Global Configuration Example

IPSec Anti-Replay Window per Crypto Map Configuration Example

IPSec Preferred Peer Configuration Examples

Default Peer Configuration Example

IPSec Idle Timer with Default Peer Configuration Example

IPSec Security Association Idle Timer Configuration Examples

IPSec SA Idle Timer Global Configuration Example

IPSec SA Idle Timer per Crypto Map Configuration Example

Distinguished Name-Based Crypto Maps Configuration Example

QoS Configuration Example

Deny Policy Enhancements for ACLs Configuration Example


Configuring Enhanced IPSec Features Using the IPSec VPN SPA


This chapter provides information about configuring enhanced IPSec features using the IPSec VPN SPA on the Cisco 7600 series router. It includes the following sections:

Overview of Enhanced IPSec Features

Configuring Advanced Encryption Standard in a Transform Set

Configuring Reverse Route Injection

Configuring the IPSec Anti-Replay Window Size

Configuring an IPSec Preferred Peer

Configuring IPSec Security Association Idle Timers

Configuring Distinguished Name-Based Crypto Maps

Configuring QoS on the SPA-IPSEC-2G IPSEC VPN SPA

Configuring QoS on the WS-IPSEC-3 IPSEC VSPA

Configuring Sequenced Crypto ACLs

Configuring Deny Policy Enhancements for Crypto ACLs

Configuration Examples


Note For detailed information on Cisco IOS IPSec cryptographic operations and policies, refer to the Cisco IOS Security Configuration Guide, Release 12.2 and Cisco IOS Security Command Reference, Release 12.2.


For information about managing your system images and configuration files, refer to the Cisco IOS Configuration Fundamentals Configuration Guide and Cisco IOS Configuration Fundamentals Command Reference publications.

For more information about the commands used in this chapter, refer to the Cisco IOS Software Releases 15.0SR Command References and to the Cisco IOS Software Releases 12.2SX Command References. Also refer to the related Cisco IOS Release 12.2 software command reference and master index publications. For more information, see the "Related Documentation" section.


Tip To ensure a successful configuration of your VPN using the IPSec VPN SPA, read all of the configuration summaries and guidelines before you perform any configuration tasks.


Overview of Enhanced IPSec Features

IPSec is a framework of open standards developed by the Internet Engineering Task Force (IETF). It provides security for transmission of sensitive information over unprotected networks such as the Internet. IPSec acts at the network layer, protecting and authenticating IP packets between participating IPSec devices (peers), such as Cisco routers.

This chapter describes the advanced IPSec features that can be used to improve scalability and performance of your IPSec VPN.

Configuring Advanced Encryption Standard in a Transform Set

The Advanced Encryption Standard (AES) is a privacy transform for IPSec and Internet Key Exchange (IKE) that has been developed to replace the Data Encryption Standard (DES). AES is designed to be more secure than DES. AES offers a larger key size, while ensuring that the only known approach to decrypt a message is for an intruder to try every possible key. AES has a variable key length. The algorithm can specify a 128-bit key (the default), a 192-bit key, or a 256-bit key.

To configure the AES encryption algorithm within a transform set, perform this task beginning in global configuration mode:

 
Command
Purpose
 

Router(config)# crypto ipsec transform-set transform-set-name transform1[transform2[transform3]]

...

Specifies a transform set and IPSec security profiles and algorithms.

transform-set-name specifies the name of the transform set.

transform1[transform2[transform3]] defines IPSec security protocols and algorithms. To configure AES, you must choose from the following AES Encapsulating Security Payload (ESP) encryption transforms:

esp-aes specifies ESP with the 128-bit AES encryption algorithm.

esp-aes 192 specifies ESP with the 192-bit AES encryption algorithm.

esp-aes 256 specifies ESP with the 256-bit AES encryption algorithm.

For other accepted transform values, and more details on configuring transform sets, see the Cisco IOS Security Command Reference.

Verifying the AES Transform Set

To verify the configuration of the transform set, enter the show crypto ipsec transform-set command:

Router# show crypto ipsec transform-set
 
   
Transform set transform-1:{esp-256-aes esp-md5-hmac}
will negotiate = {Tunnel, }
 
   

For more complete configuration information about AES support, refer to this URL:

http://www.cisco.com/en/US/docs/ios/12_2t/12_2t13/feature/guide/ft_aes.html

For an AES configuration example, see the "Advanced Encryption Standard Configuration Example" section.

Configuring Reverse Route Injection

Reverse Route Injection (RRI) provides the ability for static routes to be automatically inserted into the routing process for those networks and hosts protected by a remote tunnel endpoint. These protected hosts and networks are known as remote proxy identities.


Note RRI is supported in Cisco IOS Release 12.2(33)SRA and later releases.


Each route is created on the basis of the remote proxy network and mask, with the next hop to this network being the remote tunnel endpoint. By using the remote Virtual Private Network (VPN) router as the next hop, the traffic is forced through the crypto process to be encrypted.

After the static route is created on the VPN router, this information is propagated to upstream devices, allowing them to determine the appropriate VPN router to which to send returning traffic in order to maintain IPSec state flows. Being able to determine the appropriate VPN router is particularly useful if multiple VPN routers are used at a site to provide load balancing or failover or if the remote VPN devices are not accessible via a default route. Routes are created in either the global routing table or the appropriate virtual routing and forwarding (VRF) table.

RRI is applied on a per-crypto map basis, whether this is via a static crypto map or a dynamic crypto map template. For both dynamic and static maps, routes are created only at the time of IPSec SA creation. Routes are removed when the SAs are deleted. The static keyword can be added to the reverse-route command if routes are created on the basis of the content of the crypto ACLs that are permanently attached to the static crypto map.

RRI Configuration Guidelines and Restrictions

Follow these guidelines and restrictions when configuring RRI:


Note When RRI is enabled, do not make changes to the crypto configuration while VPN sessions are active. Enter the clear crypto session command before making changes.


IP routing should be enabled and static routes should be redistributed if dynamic routing protocols are to be used to propagate RRI-generated static routes.

You can specify an interface or address as the explicit next hop to the remote VPN device. This functionality allows the overriding of a default route to properly direct outgoing encrypted packets.

You can add a route tag value to any routes that are created using RRI. This route tag allows redistribution of groups of routes using route maps, allowing you to be selective about which routes enter your global routing table.

RRI can be configured on the same crypto map that is applied to multiple router interfaces.

The reverse-route remote-peer [static] command creates two routes. One route is the standard remote proxy ID and the next hop is the remote VPN client tunnel address. The second route is the actual route to that remote tunnel endpoint and is used when a recursive lookup requires that the remote endpoint be reachable by the next hop. Creation of the second route for the actual next hop is important in the VRF case in which a default route must be overridden by a more explicit route.

To reduce the number of routes created and support some platforms that do not readily facilitate route recursion, the reverse-route {ip-address} [static] keyword can be used to create one route only.

For devices using an IPSec VPN SPA, reverse route specifies the next hop to be the interface, subinterface, or virtual LAN (VLAN) with the crypto map applied to it.

Configuring RRI Under a Static Crypto Map

To configure RRI under a static crypto map, perform the following steps beginning in global configuration mode:

 
Command
Purpose

Step 1 

Router(config)# crypto map map-name seq-name ipsec-isakmp

Creates or modifies a crypto map entry and enters crypto map configuration mode.

map-name—Name that identifies the map set.

seq-num—Sequence number assigned to the crypto map entry.

ipsec-isakmp—Indicates that IKE will be used to establish the IPSec SAs for protecting the traffic specified by this crypto map entry.

Step 2 

Router(config-crypto-map)# reverse-route [[static] | tag tag-id [static] | remote-peer [static] | remote-peer ip-address [static]]

Creates source proxy information for a crypto map entry.

static—(Optional) Creates permanent routes based on static ACLs.

tag tag-id—(Optional) Tag value that can be used as a match value for controlling redistribution via route maps.

remote-peer [static]—(Optional) Two routes are created, one for the remote endpoint and one for route recursion to the remote endpoint via the interface to which the crypto map is applied. The static keyword is optional.

remote-peer ip-address [static]—(Optional) One route is created to a remote proxy by way of a user-defined next hop. This next hop can be used to override a default route. The ip-address argument is required. The static keyword is optional.

Configuring RRI Under a Dynamic Crypto Map

To configure RRI under a dynamic crypto map, perform the following steps beginning in global configuration mode:

 
Command
Purpose

Step 1 

Router(config)# crypto dynamic-map {dynamic-map-name} {dynamic-seq-name}

Creates a dynamic crypto map entry and enters crypto map configuration mode.

dynamic-map-name—Name that identifies the map set.

dynamic-seq-num—Sequence number assigned to the crypto map entry.

Step 2 

Router(config-crypto-map)# reverse-route [tag tag-id | remote-peer | remote-peer ip-address]

Creates source proxy information for a crypto map entry.

tag tag-id—(Optional) Tag value that can be used as a match value for controlling redistribution via route maps.

remote-peer—(Optional) Two routes are created, one for the remote endpoint and one for route recursion to the remote endpoint via the interface to which the crypto map is applied.

remote-peer ip-address—(Optional) One route is created to a remote proxy by way of a user-defined next hop. This next hop can be used to override a default route. The ip-address argument is required.

For more complete configuration information for RRI, refer to the following URL:

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gt_rrie.html

For RRI configuration examples, see the "Reverse Route Injection Configuration Examples" section.

Configuring the IPSec Anti-Replay Window Size

Cisco IPSec authentication provides anti-replay protection against an attacker duplicating encrypted packets by assigning a unique sequence number to each encrypted packet. (Security association (SA) anti-replay is a security service in which the receiver can reject old or duplicate packets to protect itself against replay attacks.) The decryptor checks off the sequence numbers that it has seen before. The encryptor assigns sequence numbers in an increasing order. The decryptor remembers the value (X) of the highest sequence number that it has already seen. N is the window size of the decryptor. Any packet with a sequence number less than X minus N is discarded. Currently, N is set at 64.


Note The IPSec anti-replay window size feature is supported in Cisco IOS Release 12.2(18)SXF6 and later releases.


At times, the 64-packet window size is not sufficient. For example, Cisco quality of service (QoS) gives priority to high-priority packets, which could cause some low-priority packets to be discarded even though they are not replayed packets. The IPSec anti-replay window size feature allows you to expand the window size so that sequence number information can be kept for more than 64 packets.


Note A change in the anti-replay window size will not take effect until after the next rekeying.


Expanding the IPSec Anti-Replay Window Size Globally

To expand the IPSec anti-replay window globally so that it affects all SAs that are created (except for those that are specifically overridden on a per-crypto map basis), perform this task beginning in global configuration mode:

Command
Purpose

Router(config)# crypto ipsec security-association replay window size [size]

Expands the IPSec anti-replay window globally to the specified size.

size—(Optional) Size of the window. Values can be 64, 128, 256, 512, or 1024. This value becomes the default value.

Expanding the IPSec Anti-Replay Window at the Crypto Map Level

To expand the IPSec anti-replay window on a crypto map basis so that it affects those SAs that have been created using a specific crypto map or profile, perform this task beginning in global configuration mode:

 
Command
Purpose

Step 1 

Router(config)# crypto map map-name seq-num ipsec-isakmp

Enters crypto map configuration mode and creates a crypto profile that provides a template for configuration of dynamically created crypto maps.

map-name—Name that identifies the map set.

seq-num—Sequence number assigned to the crypto map entry.

ipsec-isakmp—Indicates that IKE will be used to establish the IPSec SAs for protecting the traffic specified by this crypto map entry.

Step 2 

Router(config-crypto-map)# crypto ipsec security-association replay window size [size]

Controls the SAs that are created using the policy specified by a particular crypto map, dynamic crypto map, or crypto profile.

size—(Optional) Size of the window. Values can be 64, 128, 256, 512, or 1024. This value becomes the default value.

Verifying the IPSec Anti-Replay Window Size Configuration at the Crypto Map Level

To verify that IPSec anti-replay window size is enabled at a crypto map, enter the show crypto map command for that particular map. If anti-replay window size is enabled, the display will indicate that it is enabled and indicate the configured window size. If anti-replay window size is disabled, the results will indicate that also.

The following example indicates that IPSec anti-replay window size is enabled:

Router# show crypto map tag TESTMAP
 
   
Crypto Map "TESTMAP" 10 ipsec-isakmp
        WARNING: This crypto map is in an incomplete state!
                (missing peer or access-list definitions)
        No matching address list set.
        Security association lifetime: 4608000 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={ 
        }
        Antireplay window size = 128
        Interfaces using crypto map TESTMAP:
 
   

For more complete configuration information for IPSec anti-replay window size, refer to the following URL:

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gt_iarwe.html

For IPSec anti-replay window size configuration examples, see the "IPSec Anti-Replay Window Size Configuration Examples" section.


Note Anti-replay failures detected by the IPSec VPN SPA can be caused by reordering, requeueing, or fragmentation elsewhere in the network. As a defense against man-in-the-middle attacks, the IPSec VPN SPA will drop these packets. This is the expected behavior.


Disabling the IPSec Anti-Replay Checking

To disable the IPSec anti-replay checking, enter the crypto ipsec security-association replay disable command in global configuration mode as follows:

Command
Purpose

Router(config)# crypto ipsec security-association replay disable

Disables the IPSec anti-replay checking.

To disable the IPSec anti-replay checking on a particular crypto map, enter the set security-association replay disable command in crypto map configuration mode as follows:

 
Command
Purpose

Step 1 

Router(config)# crypto map map-name seq-num ipsec-isakmp

Enters crypto map configuration mode and creates a crypto profile that provides a template for configuration of dynamically created crypto maps.

map-name—Name that identifies the map set.

seq-num—Sequence number assigned to the crypto map entry.

ipsec-isakmp—Indicates that IKE will be used to establish the IPSec SAs for protecting the traffic specified by this crypto map entry.

Step 2 

Router(config-crypto-map)# set security-association replay disable

Disables IPSec anti-replay checking by a particular crypto map, dynamic crypto map, or crypto profile.

Configuring an IPSec Preferred Peer

The IP Security (IPSec) Preferred Peer feature allows you to control the circumstances by which multiple peers on a crypto map are tried in a failover scenario. If there is a default peer, the next time a connection is initiated, the connection is directed to the default peer instead of to the next peer in the peer list. If all connections to the current peer time out, the next time a connection is initiated, it is directed to the default peer.


Note The IPSec Preferred Peer feature is supported in Cisco IOS Release 12.2(33)SRA and later releases.


This feature includes the following capabilities:

Default peer configuration

If a connection timeout occurs, the connection to the current peer is closed. The set peer command allows you to configure the first peer as the default peer. If there is a default peer, the next time a connection is initiated, the connection is directed to the default peer instead of to the next peer in the peer list. If the default peer is unresponsive, the next peer in the peer list becomes the current peer and future connections through the crypto map try that peer.

This capability is useful when traffic on a physical link stops due to the failure of a remote peer. DPD indicates that the remote peer is unavailable, but that peer remains the current peer.

A default peer facilitates the failover to a preferred peer that was previously unavailable, but has returned to service. Users can give preference to certain peers in the event of a failover. This is useful if the original failure was due to a network connectivity problem rather than failure of the remote peer.

To configure a default peer, see the "Configuring a Default Peer" section.

IPSec idle timer with default peer configuration

When a router running Cisco IOS software creates an IPSec security association (SA) for a peer, resources must be allocated to maintain the SA. The SA requires both memory and several managed timers. For idle peers, these resources are wasted. If enough resources are wasted by idle peers, the router could be prevented from creating new SAs with other peers.

IPSec SA idle timers increase the availability of resources by deleting SAs associated with idle peers. Because IPSec SA idle timers prevent the wasting of resources by idle peers, more resources are available to create new SAs when required. (If IPSec SA idle timers are not configured, only the global lifetimes for IPSec SAs are applied. SAs are maintained until the global timers expire, regardless of peer activity.)

When both an IPSec SA idle timer and a default peer are configured and all connections to the current peer time out, the next time a connection is initiated it is directed to the default peer configured in the set peer command. If a default peer is not configured and there is a connection timeout, the current peer remains the one that timed out.

This enhancement helps facilitate a failover to a preferred peer that was previously unavailable but is in service now.

To configure an IPSec idle timer, see the "Configuring the IPSec Idle Timer with a Default Peer" section.

IPSec Preferred Peer Configuration Guidelines and Restrictions

When configuring an IPSec preferred peer, follow these guidelines and restrictions:

When configuring a default peer, follow these guidelines and restrictions:

Only one peer can be designated as the default peer in a crypto map.

The default peer must be the first peer in the peer list.


Note The default peer feature must be used in conjunction with Dead Peer Detection (DPD). It is most effective on a remote site running DPD in periodic mode. DPD detects the failure of a device quickly and resets the peer list so that the default peer is tried for the next attempted connection.


When configuring IPSec idle timer usage with a default peer, follow these guidelines and restrictions:

The IPSec idle timer usage with a default peer feature works only on the crypto map for which it is configured. You cannot configure the capability globally for all crypto maps.

If there is a global idle timer, the crypto map idle timer value must be different from the global value; otherwise, the idle timer is not added to the crypto map.

Configuring a Default Peer

To configure a default peer, perform this task beginning in global configuration mode:

 
Command
Purpose

Step 1 

Router(config)# crypto map map-name seq-num [ipsec-isakmp] [dynamic dynamic-map-name] [discover] [profile profile-name]

Enters crypto map configuration mode and creates a crypto profile that provides a template for configuration of dynamically created crypto maps.

map-name—Name that identifies the map set.

seq-num—Sequence number assigned to the crypto map entry.

ipsec-isakmp—(Optional) Indicates that IKE will be used to establish the IPSec SAs for protecting the traffic specified by this crypto map entry.

dynamic dynamic-map-name—(Optional) Specifies the name of the dynamic crypto map set that should be used as the policy template.

discover—(Optional) Enables peer discovery. By default, peer discovery is not enabled.

profile profile-name—(Optional) Name of the crypto profile being created.

Step 2 

Router(config-crypto-map)# set peer {host-name [dynamic] [default] | ip-address [default]}

Specifies an IPSec peer in a crypto map entry. Ensures that the first peer specified is defined as the default peer.

host-name—Specifies the IPSec peer by its host name. This is the peer's host name concatenated with its domain name (for example, myhost.example.com).

dynamic—(Optional) The host name of the IPSec peer will be resolved via a domain name server (DNS) lookup right before the router establishes the IPSec tunnel.

default—(Optional) If there are multiple IPSec peers, designates that the first peer is the default peer.

ip-address—Specifies the IPSec peer by its IP address.

Step 3 

Router(config-crypto-map)# exit

Exits crypto map configuration mode and returns to global configuration mode.

Configuring the IPSec Idle Timer with a Default Peer

To configure the IPSec idle timer with a default peer, perform this task beginning in global configuration mode:

 
Command
Purpose

Step 1 

Router(config)# crypto map map-name seq-num [ipsec-isakmp] [dynamic dynamic-map-name] [discover] [profile profile-name]

Enters crypto map configuration mode and creates a crypto profile that provides a template for configuration of dynamically created crypto maps.

map-name—Name that identifies the map set.

seq-num—Sequence number assigned to the crypto map entry.

ipsec-isakmp—(Optional) Indicates that IKE will be used to establish the IPSec SAs for protecting the traffic specified by this crypto map entry.

dynamic dynamic-map-name—(Optional) Specifies the name of the dynamic crypto map set that should be used as the policy template.

discover—(Optional) Enables peer discovery. By default, peer discovery is not enabled.

profile profile-name—(Optional) Name of the crypto profile being created.

Step 2 

Router(config-crypto-map)# set security-association idle-time seconds [default]

Specifies the maximum amount of time for which the current peer can be idle before the default peer is used.

seconds—Number of seconds for which the current peer can be idle before the default peer is used. Valid values are 600 to 86400.

default—(Optional) Specifies that the next connection is directed to the default peer.

Step 3 

Router(config-crypto-map)# exit

Exits crypto map configuration mode and returns to global configuration mode.

For complete configuration information for IPSec preferred peer, refer to this URL:

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gt_ipspp.html

For IPSec preferred peer configuration examples, see the "IPSec Preferred Peer Configuration Examples" section.

Configuring IPSec Security Association Idle Timers

When a router running Cisco IOS software creates an IPSec SA for a peer, resources must be allocated to maintain the SA. The SA requires both memory and several managed timers. For idle peers, these resources are wasted. If enough resources are wasted by idle peers, the router could be prevented from creating new SAs with other peers. The IPSec security association idle timers feature introduces a configurable idle timer to monitor SAs for activity, allowing SAs for idle peers to be deleted. The idle timers can be configured either globally, on a per-crypto map basis, or through an ISAKMP profile. The benefits of this feature include the following:

Increased availability of resources

Improved scalability of Cisco IOS IPSec deployments

IPSec Security Association Idle Timer Configuration Guidelines

When configuring idle timers on a per-crypto map basis, follow these guidelines:

The IPSec VPN SPA rounds up the CLI-configured interval to the nearest 10-minute interval. For example, if you configure 12 minutes for idle timeout, the IPSec VPN SPA uses a value of 20 minutes for idle timeout. If you configure 5 minutes, the IPSec VPN SPA uses a value of 10 minutes for idle timeout.

Because of the way the IPSec VPN SPA does idle timeout detection, it can take anywhere between one to three (ten-minute) intervals for idle timeout detection. For example, if you configured 12 minutes for idle timeout, idle timeout could happen anywhere between 20 to 60 minutes.

When the idle timer is configured globally, the idle timer configuration will be applied to all SAs.

When the idle timer is configured for a crypto map, the idle timer configuration will be applied to all SAs under the specified crypto map.

Configuring the IPSec SA Idle Timer Globally

To configure the IPSec SA idle timer globally, enter the crypto ipsec security-association idle-time command in global configuration mode as follows:

Command
Purpose

Router(config)# crypto ipsec security-association idle-time seconds

Specifies the time, in seconds, that the idle timer will allow an inactive peer to maintain an SA. The range is from 60 to 86400 seconds.

Configuring the IPSec SA Idle Timer per Crypto Map

To configure the IPSec SA idle timer for a specified crypto map, use the set security-association idle-time command within a crypto map configuration:

 
Command
Purpose

Step 1 

Router(config)# crypto map map-name seq-number ipsec-isakmp

Creates or modifies a crypto map entry and enters crypto map configuration mode.

map-name—Name that identifies the crypto map set.

seq-number—Sequence number you assign to the crypto map entry. Lower values have higher priority.

ipsec-isakmp—Indicates that IKE will be used to establish the IPSec security associations.

Step 2 

Router(config-crypto-map)# set security-association idle-time seconds

Specifies the time, in seconds, that the idle timer will allow an inactive peer to maintain an SA. The range is from 60 to 86400 seconds.

For detailed information on configuring IPSec SA idle timers, refer to the following Cisco IOS documentation:

http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ftsaidle.html

For IPSec SA idle timer configuration examples, see the "IPSec Security Association Idle Timer Configuration Examples" section.

Configuring Distinguished Name-Based Crypto Maps

The distinguished name-based crypto maps feature allows you to configure the router to restrict access to selected encrypted interfaces for those peers with specific certificates, especially certificates with particular distinguished names (DNs).

Previously, if the router accepted a certificate or a shared secret from the encrypting peer, Cisco IOS did not have a method of preventing the peer from communicating with any encrypted interface other than the restrictions on the IP address of the encrypting peer. This feature allows you to configure which crypto maps are usable to a peer based on the DN that a peer used to authenticate itself, which enables you to control which encrypted interfaces a peer with a specified DN can access. You can configure a DN-based crypto map that can be used only by peers that have been authenticated by a DN or one that can be used only by peers that have been authenticated by a hostname.

Distinguished Name-Based Crypto Map Configuration Guidelines and Restrictions

When configuring a distinguished name-based crypto map, follow these guidelines and restrictions:

If you restrict access to a large number of DNs, we recommend that you specify a few number of crypto maps referring to large identity sections instead of specifying a large number of crypto maps referring to small identity sections.

To configure a DN-based crypto map that can be used only by peers that have been authenticated by a DN, or one that can be used only by peers that have been authenticated by a hostname, perform this task beginning in global configuration mode:

 
Command
Purpose

Step 1 

Router(config)# crypto isakmp policy priority

...

Router(config-isakmp)# exit

Defines an ISAKMP policy and enters ISAKMP policy configuration mode.

priority—Identifies the IKE policy and assigns a priority to the policy. Use an integer from 1 to 10000, with 1 being the highest priority and 10000 the lowest.

Creates an ISAKMP policy at each peer.

For details on configuring an ISAKMP policy, see the Cisco IOS Security Configuration Guide.

Step 2 

Router(config)# crypto map map-name seq-number ipsec-isakmp

Creates or modifies a crypto map entry and enters the crypto map configuration mode.

map-name—Name that identifies the crypto map set.

seq-number—Sequence number you assign to the crypto map entry. Lower values have higher priority.

ipsec-isakmp—Indicates that IKE will be used to establish the IPSec security associations.

Step 3 

Router(config-crypto-map)# set identity name

...

Router(config-crypto-map)# exit

Applies the identity to the crypto map.

name—Identity of the router, which is associated with the given list of DNs.

When this command is applied, only the hosts that match a configuration listed within the identity name can use the specified crypto map.

Note If the set identity command does not appear within the crypto map, the encrypted connection does not have any restrictions other than the IP address of the encrypting peer.

Specify any other policy values appropriate to your configuration.

For details on configuring a crypto map, see the Cisco IOS Security Configuration Guide.

Step 4 

Router(config)# crypto identity name

Configures the identity of a router with the given list of DNs in the certificate of the router and enters crypto identity configuration mode.

name—The name value specified in Step 3.

Step 5 

Router(crypto-identity)# dn name=string [,name=string]| fqdn name

Associates the identity of the router with either a DN or hostname (FQDN) to restrict access to peers with specific certificates.

name=string—The DN in the certificate of the router. Optionally, you can associate more than one DN.

fqdn name—The hostname that the peer used to authenticate itself (FQDN) or the DN in the certificate of the router.

The identity of the peer must match the identity in the exchanged certificate.

For complete configuration information for Distinguished Name-Based Crypto Maps, refer to this URL:

http://www.cisco.com/en/US/docs/ios/12_2t/12_2t4/feature/guide/ftdnacl.html

For a distinguished name based crypto map configuration example, see the "Distinguished Name-Based Crypto Maps Configuration Example" section.

Configuring QoS on the SPA-IPSEC-2G IPSEC VPN SPA

The IPSec VPN SPA uses the Quality of Service (QoS) capabilities of the Cisco 7600 series router software to implement a two-level, strict-priority QoS. Before configuring QoS for the IPSec VPN SPA, refer to this URL:

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a008014a29f.shtml

The IPSec VPN SPA implements a two-level, strict-priority QoS. The Cisco 7600 SSC-400 and the IPSec VPN SPA together implement two queues for each direction, inbound and outbound. Packets are dequeued in a two-to-one ratio, meaning that two packets are dequeued from the high-priority low-latency queue (LLQ) before one packet is dequeued from the low-priority queue. Packets are enqueued based on your priority-queue configuration settings. To take advantage of the IPSec VPN SPA's QoS capability, you must use standard QoS commands to ensure that the class of service (CoS) of packets is marked on ingress. You must configure the CoS map for the inside and outside ports and you must also enable QoS globally for the IPSec VPN SPA to acknowledge the CoS mapping.

QoS Configuration Guidelines and Restrictions

When configuring QoS settings for an IPSec VPN SPA, follow these guidelines and note these restrictions:

In VRF mode, service policies should not be applied on GRE and VTI tunnel interfaces. In crypto-connect mode, service policies should not be applied on GRE tunnel interfaces if the tunnel will be taken over by the IPSec VPN SPA.

Packets are enqueued based on the mls qos command and the priority-queue configuration settings as follows:

When the mls qos command is not configured, all data packets are enqueued into the high-priority queue.

When the mls qos command is configured and no explicit priority-queue configuration is present on the IPSec VPN SPA Ethernet interfaces, only packets with a CoS value of 5 are enqueued into the high-priority queue; all other packets are enqueued into the low-priority queue.

When the mls qos command is configured and priority-queue configuration is present on the IPSec VPN SPA Ethernet interfaces, traffic is enqueued based on the priority-queue configuration.

A maximum of three CoS map values can be sent to the high-priority queue. Because the CoS value of 5 is preconfigured as high-priority, you can choose only two other values for high-priority queueing.


Note Do not configure more than three CoS map values, because any additional values will overwrite previously configured values. If you overwrite the CoS value of 5, the system will restore it, overwriting one of your other configured values. To restore an overwritten CoS map value, you must first delete the new value and then reconfigure the earlier value.


When the mls qos command is configured, you must also configure the mls qos trust command on the IPSec VPN SPA Ethernet interfaces, as in the following example:

!
Interface GigabitEthernet4/0/1
 mls qos trust cos
 priority-queue cos-map 1 0 1 5
!
Interface GigabitEthernet4/0/2
 mls qos trust cos
 priority-queue cos-map 1 0 1 5
!

In this example, the CoS values of 0, 1, and 5 are sent to the high-priority queue.

In a blade failover group, both IPSec VPN SPAs must have matching platform QoS configurations.

If the mls qos trust command is not configured, the QoS fields in all traffic will be cleared to the default level. If the mls qos trust command is configured, the QoS fields will be preserved.

For a QoS configuration example, see the "QoS Configuration Example" section.

Configuring QoS on the WS-IPSEC-3 IPSEC VSPA

Typical applications of quality of service (QoS) for VPN are the use of traffic policing to prevent a hub from overwhelming a lower-capacity spoke, and the prioritization over VPN of delay-sensitive traffic such as voice over IP (VoIP). In a system including the WS-IPSEC-3 IPSEC VSPA, QoS features for VPN traffic are provided by the WS-IPSEC-3 IPSEC VSPA module and its carrier card (SSC-600).

Module QoS—The WS-IPSEC-3 IPSEC VSPA provides traffic shaping, queuing, and bandwidth reservation services before encryption. Policies are attached to a crypto engine within the interface configuration.

Carrier QoS—For each crypto engine, the SSC-600 provides a dual-priority queue for module traffic. Policies are attached to a crypto engine.

To activate the QoS capabilities of the module and carrier, you must enable QoS globally by entering the mls qos command.

When QoS is disabled globally, the system behavior is as follows:

All QoS fields are left intact in packets.

Packets flow through only one queue in the carrier card.

When QoS is enabled globally, the default system behavior is as follows:

The default state of all ports and VLANs is the untrusted state, causing ports to clear the QoS fields in all traffic to zero unless a QoS policy is configured on the port.

Packets flow through two queues in the carrier card. Packets with a CoS value of 5 will use the higher priority queue, while all other packets will use the lower priority queue.

Before configuring QoS for VPN, see the additional information provided in the following URLs:

Configuring QoS on the Cisco 7600 series router:

http://www.cisco.com/en/US/docs/routers/7600/ios/15S/configuration/guide/qos.html

Configuring QoS Features on a SIP:

http://www.cisco.com/en/US/docs/interfaces_modules/shared_port_adapters/configuration/7600series/76cfgsip.html#wp1162382

Configuring QoS on the FlexWAN Modules:

http://www.cisco.com/en/US/docs/routers/7600/install_config/flexwan_config/flexqos.html

QoS Policing on the Cisco 7600 series router:

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a00801c8c4b.shtml

QoS Output Scheduling on the Cisco 7600 series router:

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a008015bf98.shtml

QoS Troubleshooting:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008074d6b1.shtml

Using the Module QoS Features of the WS-IPSEC-3 IPSEC VSPA

In VRF mode configurations using Virtual Tunnel Interface (VTI) or GRE with tunnel protection (TP), the WS-IPSEC-3 IPSEC VSPA can provide traffic shaping, queuing, and bandwidth reservation of outbound traffic before encryption, allowing you to prioritize traffic on a per-tunnel basis as well as to configure a shape rate for each tunnel. This section contains the following topics:

Classifying, Marking, and Policing Traffic

Setting Priority

Shaping Traffic

Reserving Bandwidth

Setting the Queue Limit

Failover

Configuring Module QoS

Classifying, Marking, and Policing Traffic

To apply the WS-IPSEC-3 IPSEC VSPA's QoS features, you must first ensure that the class of service (CoS) of packets is marked on ingress and that any necessary policing is performed before the packets are passed to the WS-IPSEC-3 IPSEC VSPA.

The Cisco 7600 series router performs classification, marking, and policing of traffic to the WS-IPSEC-3 IPSEC VSPA. These functions are configured using the following commands:

Use the class-map command to classify types of traffic.

Use the set command to mark the CoS or DSCP bits for a traffic class.

Use the police command to limit the rate of a traffic class.

Setting Priority

For each tunnel, the WS-IPSEC-3 IPSEC VSPA provides one high-priority low-latency queue (LLQ) for latency-sensitive outbound traffic, such as VoIP. The high priority queue is served ahead of other queues in that tunnel. The priority policy-map class configuration command gives priority to a class of traffic belonging to a policy map, causing that traffic to be diverted to the high-priority queue. Only one priority level per tunnel is supported. When the priority command is used in a class map, no form of the bandwidth command is allowed in the same class map.

Shaping Traffic

The shape average policy-map class configuration command specifies a maximum data rate for a class of outbound traffic. While policing enforces a maximum rate by dropping or marking down excess packets, shaping queues the excess packets for sending at a later time. Packets exceeding the maximum rate will be delayed but will not be dropped unless excess traffic is sustained at rates higher than the configured shape rate for long periods of time, causing shape buffers to overflow.

When shaping is applied to a tunnel, all traffic in the tunnel must be included in the default class. Any additional classes must be defined in a child policy.

To configure traffic shaping in the WS-IPSEC-3 IPSEC VSPA, use the shape average rate bc be command, where the rate argument specifies the maximum average bit rate and the optional be argument is the allowed excess burst level. The optional bc argument (the committed burst size) is ignored, but if be is specified, then bc must be configured to a value of at least the number of bits transferred during 4 milliseconds of traffic at the shape rate. The shape average command can be configured only for the tunnel top-level policy. It cannot be used in a child policy.

Reserving Bandwidth

The bandwidth policy-map class configuration command reserves a minimum bandwidth for a class of traffic. You can configure the bandwidth command in a child policy to reserve either an absolute rate or a percentage of the tunnel shape rate. If the priority command is configured on another class map within the same policy map, only the bandwidth remaining form of the bandwidth command (which is bandwidth remaining percent) can be used, since the higher priority traffic overrules any bandwidth guarantees.

When you configure bandwidth reservation for a class, your settings are checked for capacity and oversubscription relative to the maximum shape rate. If a tunnel aggregate shaper is not configured, any configuration of bandwidth reservation will be rejected.

Setting the Queue Limit

The queue-limit policy-map class configuration command specifies the maximum number of packets the queue can hold for a class policy configured in a policy map. The WS-IPSEC-3 IPSEC VSPA supports only a packet-based queue limiting, and supports queue-limit configuration only on a class map.

Failover

If you deploy two WS-IPSEC-3 IPSEC VSPAs for intrachassis stateful failover using a blade failure group (BFG), the QoS configuration on the active WS-IPSEC-3 IPSEC VSPA is automatically reflected on the standby module. During a failover, packets in the queue are lost. The standby WS-IPSEC-3 IPSEC VSPA takes over, scheduling newly-received packets according to the QoS configuration. Interchassis failover is not supported.

Configuring Module QoS

Module QoS configuration in the WS-IPSEC-3 IPSEC VSPA uses the Cisco Modular QoS CLI (MQC) framework. You can define traffic classes, associate policies and actions to each traffic class, and attach these policies to interfaces by following these steps:


Step 1 Define traffic classes using match statements with the class-map command.

Step 2 Configure policies using the defined traffic classes with the policy-map command.

Step 3 Within the interface configuration, attach policies to a crypto engine with the service-policy command.


For the module QoS, attach the service policy to the tunnel interface in the config-crypto-engine configuration mode after entering the crypto-engine interface level command.

The WS-IPSEC-3 IPSEC VSPA supports a hierarchical policy using two service policy levels:

A parent policy, supporting only a single default class, to apply a QoS mechanism to a traffic aggregate.

A child policy to apply a QoS mechanism to a flow or subset of the aggregate.

Logical interfaces, such as subinterfaces and tunnel interfaces, require a hierarchical policy with the traffic-shaping feature at the parent level and queuing at lower levels. While the traffic-shaping feature regulates the output rate, queuing may introduce additional latency or cause packet drops when the ingress traffic rate surpasses the configured queuing capacity.

For each tunnel, the WS-IPSEC-3 IPSEC VSPA supports a child policy with up to 8 classes, including the default-class. Only one of the 8 traffic classes can be configured as a priority class on a tunnel interface. You can configure bandwidth reservation on any class that is not configured as the priority class. You cannot configure shaping on a traffic class (a child shaper); a single aggregate shaper can be configured in the parent policy.

Module QoS Configuration Guidelines and Restrictions

When configuring QoS settings for the WS-IPSEC-3 IPSEC VSPA, follow these guidelines and note these restrictions:

To use the QoS features of the WS-IPSEC-3 IPSEC VSPA, you must enable QoS globally by entering the mls qos command.

Because the WS-IPSEC-3 IPSEC VSPA performs QoS functions only on tunnel interfaces associated with the WS-IPSEC-3 IPSEC VSPA, configuring module QoS on a tunnel interface will always result in the tunnel being taken over.

When module QoS is configured on a GRE/TP tunnel, the GRE processing is taken over by the WS-IPSEC-3 IPSEC VSPA.

The WS-IPSEC-3 IPSEC VSPA performs QoS functions only on VTI or GRE/TP interfaces in VRF mode. The QoS functions are not supported with crypto connect mode or DMVPN.

The QoS functions operate only on IPv4 traffic.

QoS is supported for up to 2000 VTI tunnels or 1000 GRE/TP tunnels.

The WS-IPSEC-3 IPSEC VSPA supports a maximum of 8 traffic classes per tunnel, including the default class.

We recommend that you configure one class as class-default.

One traffic class can be configured as priority, to be processed ahead of all other classes. This class is typically used for voice or other latency-sensitive traffic.

Each class can be configured separately for bandwidth reservation and a queue limit.

You cannot configure priority setting and bandwidth reservation within the same class map.

When configuring bandwidth reservation, note the following guidelines:

Bandwidth reservation means a minimum bandwidth guarantee when 100 percent of the configured shape rate is utilized. If less than 100 percent is used, any class may use the available bandwidth above its configured reservation.

If no bandwidth is reserved for the default class, then 1 percent of the shape rate will be automatically reserved for the default class.

The WS-IPSEC-3 IPSEC VSPA supports one aggregate shaper per tunnel, to be defined at the tunnel (parent) level. All traffic within the tunnel must be included in the shaper. If a shaper is defined, only the class-default class should be defined at the tunnel level, with the shaper applied to it. All other traffic classes must be defined in child policies.

Any tunnel that uses module QoS functions must have a shaping policy.

Because the WS-IPSEC-3 IPSEC VSPA relies on the ToS/CoS bits to classify and queue the packets properly, you should ensure that packets arriving at the WS-IPSEC-3 IPSEC VSPA have already been properly classified and marked.

The dropping policy is Random Early Detection (RED), and the RED parameters are not configurable. You cannot configure fair queueing.

Bandwidth is reserved per class for each tunnel independently. The minimum bandwidth guarantee on a class level will not propagate to the tunnel level. There is no bandwidth guarantee on a tunnel. You cannot configure an explicit minimum rate at the tunnel level.

You should avoid any policy that causes the reordering or dropping of post-encrypted packets.

The configuration of priority applies only within the tunnel in which it is configured, and does not affect other tunnels.

Increasing the queue limit increases latency.

Configuring a Child and Parent Policy

To configure a child and parent policy, perform these steps:

 
Command
Purpose

Step 1 

Router(config)# policy-map child_policy_name

Enters the policy map configuration for the specified child policy map.

Step 2 

Router(config-pmap)# class [child_policy_name | class-default]

Enters the policy map class configuration for the default class map.

Step 3 

Router(config-pmap-c)# priority

(Optional) Enables strict-priority (low latency queuing) on the class.

Step 4 

Router(config-pmap-c)# bandwidth {kbps | bandwidth percent percentage | bandwidth remaining percent percentage}

(Optional) Enables minimum bandwidth reservation on a traffic class.

bandwidth kbps — Specifies the reserved bandwidth as an absolute value in kbps that cannot exceed the configured tunnel shape rate.

bandwidth percent percentage — Specifies the reserved bandwidth as a percentage of the configured tunnel shape rate.

bandwidth remaining percent percentage — Specifies the reserved bandwidth as a percentage of the remaining tunnel bandwidth up to the configured tunnel shape rate after all LLQ packets have been served.

Step 5 

Router(config-pmap-c)# queue-limit number_of_packets

(Optional) Sets the maximum size (in packets) of the traffic queue for the class.

Step 6 

Router(config-pmap-c)# exit

Exits the policy map class configuration.

Step 7 

Router(config-pmap)# exit

Exits the policy map configuration.

Step 8 

Router(config)# policy-map parent_policy_name

Enters the policy map configuration for the specified parent policy map.

Step 9 

Router(config-pmap)# class class-default

Enters the policy map class configuration for the default class map.

Step 10 

Router(config-pmap-c)# shape average rate [bc be]

Enables average rate traffic shaping.

rate—Specifies the committed information rate (CIR), in bits per second (bps).

bc—(Optional) Specifies the committed burst size, in bits. This field will be ignored, but must be set to a legal value if be is specified.

be—(Optional) Specifies the excess burst size, in bits.

Step 11 

Router(config-pmap-c)# service-policy child_policy_name

(Optional) Attaches a child policy map with up to seven additional class maps. Including the class-default class map, there can be a total of up to eight class maps.

Step 12 

Router(config-pmap-c)# exit

Exits the policy map class configuration.

Step 13 

Router(config-pmap)# exit

Exits the policy map configuration.

The bandwidth and bandwidth percent commands cannot be configured in conjunction with the priority command. The bandwidth remaining percent command can be configured in conjunction with the priority command.

By default, the queue limit is 1000 for all non-LLQ traffic classes; for LLQ classes, the default is the number of packets that can be transferred in 4 milliseconds at the configured shape rate.

The shape rate can range from 128 Kbps to 1 Gbps. If a tunnel has a low shape rate, we recommend that you also configure a small excess burst size (be).

The default excess burst size (be) is the number of bits transferred during 4 milliseconds of traffic at the shape rate. For example, for a 256000 bps shape rate, the default excess burst size will be 1024 bits.

If you configure be, then you must configure bc (the committed burst size) to a value of at least the number of bits transferred during 4 milliseconds of traffic at the shape rate.


Note We recommend that you allow the system to determine settings for bc and be.


For QoS configuration examples, see the "QoS Configuration Examples" section.

Using the Carrier QoS Features of the SSC-600

The SSC-600 implements a two-level, strict-priority QoS with two queues for each direction, inbound and outbound. Packets are dequeued in a two-to-one ratio, meaning that two packets are dequeued from the high-priority low-latency queue (LLQ) before one packet is dequeued from the low-priority queue. Packets are enqueued based on your priority-queue configuration settings. To take advantage of the SSC-600's QoS capability, you must use standard QoS commands to ensure that the class of service (CoS) of packets is marked on ingress. You must configure the CoS map for the inside and outside ports and you must also enable QoS globally for the SSC-600 to acknowledge the CoS mapping.

Carrier QoS Configuration Guidelines and Restrictions

When configuring QoS settings for an SSC-600, follow these guidelines and note these restrictions:

Packets are enqueued based on the mls qos command and the priority-queue configuration settings as follows:

When the mls qos command is not configured, all data packets are enqueued into the high-priority queue.

When the mls qos command is configured and no explicit priority-queue configuration is present on the WS-IPSEC-3 IPSEC VSPA ethernet interfaces, only packets with a CoS value of 5 are enqueued into the high-priority queue; all other packets are enqueued into the low-priority queue.

When the mls qos command is configured and priority-queue configuration is present on the WS-IPSEC-3 IPSEC VSPA ethernet interfaces, traffic is enqueued based on the priority-queue configuration.

A maximum of three CoS map values can be sent to the high-priority queue. Because the CoS value of 5 is preconfigured as high-priority, you can choose only two other values for high-priority queueing.


Note Do not configure more than three CoS map values because any additional values will overwrite previously configured values. If you overwrite the CoS value of 5, the system will restore it, overwriting one of your other configured values. To restore an overwritten CoS map value, you must first delete the new value and then reconfigure the earlier value.


When the mls qos command is configured, you must also configure the mls qos trust command on the WS-IPSEC-3 IPSEC VSPA ethernet interfaces, as in the following example:

Interface GigabitEthernet4/0/1
 mls qos trust cos
 priority-queue cos-map 1 0 1 5
!
Interface GigabitEthernet4/0/2
 mls qos trust cos
 priority-queue cos-map 1 0 1 5
 
   

In this example, the CoS values of 0, 1, and 5 are sent to the high-priority queue.

In a blade failover group, both WS-IPSEC-3 IPSEC VSPAs must have matching carrier QoS configurations.

If the mls qos trust command is not configured, the QoS fields in all traffic will be cleared to the default level. If the mls qos trust command is configured, the QoS fields will be preserved.

For a configuration example of module QoS, see the "Module QoS Configuration Example" section.

QoS Configuration Examples

This section provides examples of the following configurations:

Carrier QoS Configuration Example

Module QoS Configuration Example

Carrier QoS Configuration Example

The following example shows how to configure carrier QoS:

mls qos
!
Interface GigabitEthernet4/0/1
 mls qos trust cos
 priority-queue cos-map 1 0 1 5
!
Interface GigabitEthernet4/0/2
 mls qos trust cos
 priority-queue cos-map 1 0 1 5
 
   

Module QoS Configuration Example

The following example shows how to configure module QoS:

upgrade fpd auto
version 
service timestamps debug datetime
service timestamps log datetime
no service password-encryption
service internal
service counters max age 10
!
hostname HUB2
!
boot-start-marker
boot system disk0:
boot-end-marker
!
logging buffered 1000000
!
no aaa new-model
clock timezone PST -8
ip subnet-zero
!
!
no ip domain-lookup
ip domain-name cisco.com
!
vtp domain same_domain
vtp mode off
mls qos
mls netflow interface
no mls flow ip
no mls flow ipv6
mls ip slb purge global
no mls acl tcam share-global
mls cef error action reset
mls mpls tunnel-recir
call admission limit 90
!
crypto pki trustpoint MSCA
 enrollment mode ra
 enrollment url http://43.0.111.111:80/certsrv/mscep/mscep.dll
 serial-number
 ip-address none
 subject-name cn=HUB2,ou=isbu,o=cisco
 revocation-check none
!
!
crypto pki certificate chain MSCA
 certificate 1C67C77C0000000004C4
 certificate ca 7C0299B7C394F789436EBEFCCEAED66D
crypto engine mode vrf
crypto engine gre vpnblade
!
!
!
!
!
fabric timer 15
!
power redundancy-mode combined
diagnostic bootup level minimal
diagnostic monitor syslog
diagnostic cns publish cisco.cns.device.diag_results
diagnostic cns subscribe cisco.cns.device.diag_commands
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
no spanning-tree vlan 2-7
!
!
!
redundancy
 main-cpu
  auto-sync running-config
 mode sso
!
vlan internal allocation policy descending
vlan access-log ratelimit 2000
!
vlan 1
 tb-vlan1 1002
 tb-vlan2 1003
!
vlan 2-1001
!
vlan 1002
 tb-vlan1 1
 tb-vlan2 1003
!
vlan 1003
 tb-vlan1 1
 tb-vlan2 1002
 parent 1005
 backupcrf enable
!
vlan 1004
 bridge 1
 stp type ibm
!
vlan 1005
 bridge 1
!
class-map match-any class7
  match  dscp cs7
class-map match-any class6
  match  dscp cs6
class-map match-any class5
  match  dscp cs5
class-map match-any class4
  match  dscp cs4
class-map match-any class3
  match  dscp cs3
class-map match-any class2
  match  dscp cs2
class-map match-any class1
  match  dscp cs1
class-map match-any class567
  match  dscp cs5  cs6  cs7
class-map match-any class34
  match  dscp cs3  cs4
class-map match-any class12
  match  dscp cs1  cs2
!
!
policy-map Tunnel0ChildPolicy
  class class567
    priority
    queue-limit 100 packets
  class class34
    bandwidth remaining percent 40
  class class12
    bandwidth remaining percent 40
  class class-default
    bandwidth remaining percent 20
!
policy-map Tunnel0ParentPolicy
  class class-default
    shape average 1544000
   service-policy Tunnel0ChildPolicy
!
policy-map Tunnel1ChildPolicy
  class class7
    bandwidth percent 20
    queue-limit 100 packets
  class class6
    bandwidth percent 20
    queue-limit 100 packets
  class class5
    bandwidth percent 10
    queue-limit 100 packets
  class class4
    bandwidth percent 10
  class class3
    bandwidth percent 10
  class class2
    bandwidth percent 10
  class class1
    bandwidth percent 10
  class class-default
    bandwidth percent 10
!
policy-map Tunnel1ParentPolicy
  class class-default
    shape average 34000000 136000 0
   service-policy Tunnel1ChildPolicy
!
policy-map Tunnel2ChildPolicy
  class class7
    bandwidth 20000
  class class6
    bandwidth 20000
  class class5
    bandwidth 10000
  class class4
    bandwidth 10000
  class class3
    bandwidth 10000
  class class2
    bandwidth 10000
  class class1
    bandwidth 10000
  class class-default
    bandwidth 10000
!
policy-map Tunnel2ParentPolicy
  class class-default
    shape average 100000000
   service-policy Tunnel2ChildPolicy
!
policy-map Tunnel3ChildPolicy
  class class567
    bandwidth percent 30
  class class34
    bandwidth percent 30
  class class12
    bandwidth percent 20
  class class-default
    bandwidth percent 20
!
policy-map Tunnel3ParentPolicy
  class class-default
    shape average 1000000000
   service-policy Tunnel3ChildPolicy
!
policy-map Tunnel4ChildPolicy
  class class7
    priority
  class class6
    bandwidth remaining percent 20
  class class5
    bandwidth remaining percent 20
  class class4
    bandwidth remaining percent 20
  class class3
    bandwidth remaining percent 10
  class class2
    bandwidth remaining percent 10
  class class1
    bandwidth remaining percent 10
  class class-default
    bandwidth remaining percent 10
!
policy-map Tunnel4ParentPolicy
  class class-default
    shape average 256000
   service-policy Tunnel4ChildPolicy
!
policy-map Tunnel5ParentPolicy
  class class-default
    shape average 128000 512 0
!
!
!
!
crypto isakmp policy 10
 encr aes
 group 2
 lifetime 7200
crypto isakmp invalid-spi-recovery
!
!
crypto ipsec transform-set MyTranSet esp-aes 256 esp-sha-hmac
no crypto ipsec nat-transparency udp-encaps
!
crypto ipsec profile MyIpsecProf
 set transform-set MyTranSet
!
!
buffers small permanent 1024
buffers small max-free 1500
buffers small min-free 500
buffers middle permanent 512
buffers middle max-free 3000
buffers middle min-free 100
buffers big permanent 1000
buffers big max-free 1000
buffers big min-free 300
!
!
interface Tunnel0
 bandwidth 10000000
 ip address 3.0.0.1 255.255.255.0
 ip hello-interval eigrp 10 60
 ip hold-time eigrp 10 180
 tunnel source Loopback0
 tunnel destination 5.0.0.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile MyIpsecProf
 crypto engine slot 4/0 inside
 crypto-engine
     service-policy output Tunnel0ParentPolicy
!
interface Tunnel1
 bandwidth 10000000
 ip address 3.0.1.1 255.255.255.0
 ip hello-interval eigrp 10 60
 ip hold-time eigrp 10 180
 tunnel source Loopback1
 tunnel destination 5.0.1.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile MyIpsecProf
 crypto engine slot 4/0 inside
 crypto-engine
     service-policy output Tunnel1ParentPolicy
!
interface Tunnel2
 bandwidth 10000000
 ip address 3.0.2.1 255.255.255.0
 ip hello-interval eigrp 10 60
 ip hold-time eigrp 10 180
 tunnel source Loopback2
 tunnel destination 5.0.2.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile MyIpsecProf
 crypto engine slot 4/0 inside
 crypto-engine
     service-policy output Tunnel2ParentPolicy
!
interface Tunnel3
 bandwidth 10000000
 ip address 3.0.3.1 255.255.255.0
 ip hello-interval eigrp 10 60
 ip hold-time eigrp 10 180
 tunnel source Loopback3
 tunnel destination 5.0.3.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile MyIpsecProf
 crypto engine slot 4/0 inside
 crypto-engine
     service-policy output Tunnel3ParentPolicy
!
interface Tunnel4
 bandwidth 10000000
 ip address 3.0.4.1 255.255.255.0
 ip hello-interval eigrp 10 60
 ip hold-time eigrp 10 180
 tunnel source Loopback4
 tunnel destination 5.0.4.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile MyIpsecProf
 crypto engine slot 4/0 inside
 crypto-engine
     service-policy output Tunnel4ParentPolicy
!
interface Tunnel5
 bandwidth 10000000
 ip address 3.0.5.1 255.255.255.0
 ip hello-interval eigrp 10 60
 ip hold-time eigrp 10 180
 tunnel source Loopback5
 tunnel destination 5.0.5.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile MyIpsecProf
 crypto engine slot 4/0 inside
 crypto-engine
     service-policy output Tunnel5ParentPolicy
!
interface Loopback0
 ip address 4.0.0.1 255.255.255.255
!
interface Loopback1
 ip address 4.0.1.1 255.255.255.255
!
interface Loopback2
 ip address 4.0.2.1 255.255.255.255
!
interface Loopback3
 ip address 4.0.3.1 255.255.255.255
!
interface Loopback4
 ip address 4.0.4.1 255.255.255.255
!
interface Loopback5
 ip address 4.0.5.1 255.255.255.255
!
interface TenGigabitEthernet2/1
 description EGRESS INTERFACE
 mtu 9216
 ip address 6.0.0.1 255.255.255.0
 load-interval 30
 shutdown
 mls qos trust dscp
 crypto engine slot 4/0 outside
 hold-queue 4096 in
!
interface TenGigabitEthernet2/2
 no ip address
 shutdown
!
interface TenGigabitEthernet2/3
 description INGRESS INTERFACE
 switchport
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 2-7
 switchport mode trunk
 mtu 9216
 load-interval 30
 mls qos trust dscp
 hold-queue 4096 in
!
interface TenGigabitEthernet2/4
 description TO TESTCENTER PORT 2/2 (NOT IN USE)
 mtu 9216
 no ip address
 load-interval 30
 shutdown
!
interface TenGigabitEthernet2/5
 no ip address
 shutdown
!
interface TenGigabitEthernet2/6
 no ip address
 shutdown
!
interface TenGigabitEthernet2/7
 no ip address
 shutdown
!
interface TenGigabitEthernet2/8
 no ip address
 shutdown
!
interface GigabitEthernet4/0/1
 switchport
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan none
 switchport mode trunk
 mtu 9216
 wrr-queue cos-map 2 1 4
 priority-queue cos-map 1 5 6 7
 rcv-queue cos-map 1 3 4
 mls qos trust dscp
 flowcontrol receive on
 flowcontrol send off
 spanning-tree portfast edge trunk
!
interface GigabitEthernet4/0/2
 switchport
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan none
 switchport mode trunk
 mtu 9216
 wrr-queue cos-map 2 1 4
 priority-queue cos-map 1 5 6 7
 rcv-queue cos-map 1 3 4
 mls qos trust dscp
 flowcontrol receive on
 flowcontrol send off
 spanning-tree portfast edge trunk
!
interface GigabitEthernet5/1
 no ip address
 shutdown
!
interface GigabitEthernet5/2
 description LABNET
 ip address 44.0.111.118 255.0.0.0
 media-type rj45
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan2
 mtu 9216
 ip address 1.0.0.1 255.255.255.0
!
interface Vlan3
 mtu 9216
 ip address 1.0.1.1 255.255.255.0
!
interface Vlan4
 mtu 9216
 ip address 1.0.2.1 255.255.255.0
!
interface Vlan5
 mtu 9216
 ip address 1.0.3.1 255.255.255.0
!
interface Vlan6
 mtu 9216
 ip address 1.0.4.1 255.255.255.0
!
interface Vlan7
 mtu 9216
 ip address 1.0.5.1 255.255.255.0
!
router eigrp 10
 network 3.0.0.0
 no auto-summary
 distribute-list T0000 out Tunnel0
 distribute-list T0001 out Tunnel1
 distribute-list T0002 out Tunnel2
 distribute-list T0003 out Tunnel3
 distribute-list T0004 out Tunnel4
 distribute-list T0005 out Tunnel5
 timers active-time 10
 redistribute connected metric 900 100 255 1 1400
!
router ospf 10
 log-adjacency-changes
 summary-address 4.0.0.0 255.0.0.0
 redistribute connected metric 10 subnets
 network 6.0.0.0 0.0.0.255 area 0
 distribute-list 10 out
!
ip default-gateway 44.0.100.1
ip classless
ip route 43.0.0.0 255.0.0.0 44.0.100.1
ip route 223.255.254.53 255.255.255.255 44.0.100.1
!
!
no ip http server
no ip http secure-server
!
!
ip access-list standard T0000
 permit 1.0.0.0 0.0.0.255
ip access-list standard T0001
 permit 1.0.1.0 0.0.0.255
ip access-list standard T0002
 permit 1.0.2.0 0.0.0.255
ip access-list standard T0003
 permit 1.0.3.0 0.0.0.255
ip access-list standard T0004
 permit 1.0.4.0 0.0.0.255
ip access-list standard T0005
 permit 1.0.5.0 0.0.0.255
logging alarm informational
logging 43.0.111.111
access-list 10 permit 4.0.0.0 0.255.255.255
!
!
!
!
no cdp run
!
!
control-plane
!
!
dial-peer cor custom
!
!
!
!
line con 0
 exec-timeout 0 0
line vty 0 4
 password cisco
 login
line vty 5 15
 login
!
exception core-file
mac-address-table aging-time 0
ntp clock-period 17219357
ntp update-calendar
ntp server 223.255.254.53
!
end
 
   
 
   

Configuring Sequenced Crypto ACLs

Access control lists (ACLs) are made up of access control entries (ACEs). With sequenced ACLs, ACEs can be entered with a sequence number in front of the ACE and the ACEs are then processed by sequence number. Additionally, ACEs can be deleted one at a time by using the sequence number in the front of the ACE that you want to delete. The sequence numbers do not appear in the configuration but they can be displayed using the show access-list command.


Note If an ACE is removed or modified, the ACL is reconfigured on the IPSec VPN SPA, which might result in tearing down existing sessions.


Configuring Deny Policy Enhancements for Crypto ACLs

Specifying a deny address range in an ACL results in "jump" behavior. When a denied address range is hit, it forces the search to "jump" to the beginning of the ACL associated with the next sequence in a crypto map and continue the search. If you want to pass clear traffic on these addresses, you must insert a deny address range for each sequence in a crypto map. In turn, each permit list of addresses inherits all the deny address ranges specified in the ACL. A deny address range causes the software to do a subtraction of the deny address range from a permit list, and creates multiple permit address ranges that need to be programmed in hardware. This behavior can cause repeated address ranges to be programmed in the hardware for a single deny address range, resulting in multiple permit address ranges in a single ACL. To avoid this problem, use the crypto ipsec ipv4-deny {jump | clear | drop} command set as follows:

The jump keyword results in the standard "jump" behavior.

The clear keyword allows a deny address range to be programmed in hardware. The deny addresses are then filtered out for encryption and decryption. If the VPN mode is crypto-connect, when a deny address is hit, the search is stopped and traffic is allowed to pass in the clear (unencrypted) state. If the VPN mode is VRF, the deny address matching traffic is dropped.

The drop keyword causes traffic to be dropped when a deny address is hit.

The clear and drop keywords can be used to prevent repeated address ranges from being programmed in the hardware, resulting in more efficient TCAM space utilization.

Deny Policy Enhancements for Crypto ACLs Configuration Guidelines and Restrictions

When configuring the deny policy enhancements, follow these guidelines and restrictions:

The crypto ipsec ipv4-deny {jump | clear | drop} command is a global command that is applied to a single IPSec VPN SPA. The specified keyword (jump, clear, or drop) is propagated to the ACE software of the IPSec VPN SPA. The default behavior is jump.

When the clear keyword is used with VRF mode, deny address traffic is dropped rather than passed in the clear state. VRF mode does not pass traffic in the clear state.

If you apply the specified keyword (jump, clear, or drop) when crypto maps are already configured on the IPSec VPN SPA, all existing IPSec sessions are temporarily removed and restarted, which impacts traffic on your network.

The number of deny entries that can be specified in an ACL are dependent on the keyword specified:

jump—Supports up to 8 deny entries in an ACL.


Note The limit of 8 deny jump entries in an ACL should be considered a guideline rather than a fixed limit. Depending on your configuration, the practical limit could be fewer than 8.


clear—Supports up to 1000 deny entries in an ACL.

drop—Supports up to 1000 deny entries in an ACL.

For a deny policy enhancements configuration example, see the "Deny Policy Enhancements for ACLs Configuration Example" section.

Configuration Examples

This section provides examples of the following configurations:

Advanced Encryption Standard Configuration Example

Reverse Route Injection Configuration Examples

IPSec Anti-Replay Window Size Configuration Examples

IPSec Preferred Peer Configuration Examples

IPSec Security Association Idle Timer Configuration Examples

Distinguished Name-Based Crypto Maps Configuration Example

QoS Configuration Example

Deny Policy Enhancements for ACLs Configuration Example


Note The following examples use commands at the level of Cisco IOS Release 12.2(33)SRA.

As of Cisco IOS Release 12.2(33)SRA, the crypto engine subslot command used in previous releases has been replaced with the crypto engine slot command (of the form crypto engine slot slot {inside | outside}). The crypto engine subslot command is no longer supported. When upgrading, ensure that this command has been modified in your start-up configuration to avoid extended maintenance time.


Advanced Encryption Standard Configuration Example

The following example configures the Advanced Encryption Standard (AES) 256-bit key:

crypto ipsec transform-set aesset esp-aes 256 esp-sha-hmac
 mode transport
crypto map aesmap 10 ipsec-isakmp
 set peer 10.0.110.1
 set transform-set aesset
 
   

Reverse Route Injection Configuration Examples

The following examples show how to configure RRI:

RRI Under a Static Crypto Map Configuration Example

RRI Under a Dynamic Crypto Map Configuration Example

RRI with Existing ACLs Configuration Example

RRI for Two Routes Configuration Example

RRI Through a User-Defined Hop Configuration Example

RRI Under a Static Crypto Map Configuration Example

The following example shows how to configure RRI under a static crypto map. In this example, the RRI-created route has been tagged with a tag number. This tag number can then be used by a routing process to redistribute the tagged route through a route map:

Router(config)# crypto map mymap 1 ipsec-isakmp 
Router(config-crypto-map)# reverse-route tag 5
 
   

RRI Under a Dynamic Crypto Map Configuration Example

The following example shows how to configure RRI under a dynamic crypto map:

Router(config)# crypto dynamic-map mymap 1 
Router(config-crypto-map)# reverse-route remote peer 10.1.1.1
 
   

RRI with Existing ACLs Configuration Example

The following example shows how to configure RRI for a situation in which there are existing ACLs:

Router(config)# crypto map mymap 1 ipsec-isakmp
Router(config-crypto-map)# set peer 172.17.11.1
Router(config-crypto-map)# reverse-route static
Router(config-crypto-map)# set transform-set esp-3des-sha
Router(config-crypto-map)# match address 101
 
   
access-list 101 permit ip 192.168.1.0 0.0.0.255 172.17.11.0 0.0.0.255
 
   

RRI for Two Routes Configuration Example

The following example shows how to configure two routes, one for the remote endpoint and one for route recursion to the remote endpoint via the interface on which the crypto map is configured:

Router(config-crypto-map)# reverse-route remote-peer
 
   

RRI Through a User-Defined Hop Configuration Example

The following example shows that one route has been created to the remote proxy through a user-defined next hop. This next hop should not require a recursive route lookup unless it will recurse to a default route.

Router(config-crypto-map)# reverse-route remote-peer 10.4.4.4
 
   

IPSec Anti-Replay Window Size Configuration Examples

The following examples show how to configure the IPSec anti-replay window size:

IPSec Anti-Replay Window Global Configuration Example

IPSec Anti-Replay Window per Crypto Map Configuration Example

IPSec Anti-Replay Window Global Configuration Example

The following example shows that the anti-replay window size has been set globally to 1024:

service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname VPN-Gateway1
!
boot-start-marker
boot-end-marker
!
clock timezone EST 0
no aaa new-model
ip subnet-zero
!
ip audit po max-events 100
no ftp-server write-enable
!
crypto isakmp policy 10
 authentication pre-share
 crypto isakmp key cisco123
 address 192.165.201.2 
!
crypto ipsec security-association replay window-size 1024 
!
crypto ipsec transform-set basic esp-des esp-md5-hmac 
!
crypto map mymap 10 ipsec-isakmp
 set peer 192.165.201.2
 set transform-set basic
 match address 101
!
interface Ethernet0/0
 ip address 192.168.1.1 255.255.255.0
!
interface Serial1/0
 ip address 192.165.200.2 255.255.255.252  
 serial restart-delay 0  
 crypto map mymap 
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.165.200.1
no ip http server
no ip http secure-server
!
access-list 101 permit ip 192.168.1.0 0.0.0.255 172.16.2.0 0.0.0.255 
!access-list 101 remark Crypto ACL
!
control-plane
!
line con 0
line aux 0
line vty 0 4
end
 
   

IPSec Anti-Replay Window per Crypto Map Configuration Example

The following example shows that anti-replay checking is disabled for IPSec connections to 172.150.150.2, but enabled (and the default window size is 64) for IPSec connections to 172.150.150.3 and 172.150.150.4:

service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname dr_whoovie
!
enable secret 5 $1$KxKv$cbqKsZtQTLJLGPN.tErFZ1 
enable password ww 
!
ip subnet-zero
cns event-service server
crypto isakmp policy 1
 authentication pre-share
 crypto isakmp key cisco170 
 address 172.150.150.2 
 crypto isakmp key cisco180 
 address 172.150.150.3 
 crypto isakmp key cisco190 
 address 172.150.150.4
crypto ipsec transform-set 170cisco esp-des esp-md5-hmac 
crypto ipsec transform-set 180cisco esp-des esp-md5-hmac 
crypto ipsec transform-set 190cisco esp-des esp-md5-hmac
crypto map ETH0 17 ipsec-isakmp
 set peer 172.150.150.2
 set security-association replay disable  
 set transform-set 170cisco  
 match address 170 
crypto map ETH0 18 ipsec-isakmp  
 set peer 150.150.150.3  
 set transform-set 180cisco  
 match address 180 
crypto map ETH0 19 ipsec-isakmp  
 set peer 150.150.150.4  
 set transform-set 190cisco  
 match address 190 
!
interface Ethernet0
 ip address 172.150.150.1 255.255.255.0
 no ip directed-broadcast
 no ip route-cache
 no ip mroute-cache
 no mop enabled
 crypto map ETH0
!
interface Serial0
 ip address 172.160.160.1 255.255.255.0
 no ip directed-broadcast
 no ip mroute-cache
 no fair-queue
!
ip classless
ip route 172.170.170.0 255.255.255.0 172.150.150.2 
ip route 172.180.180.0 255.255.255.0 172.150.150.3 
ip route 172.190.190.0 255.255.255.0 172.150.150.4 
no ip http server 
!
access-list 170 permit ip 172.160.160.0 0.0.0.255 172.170.170.0 0.0.0.255 
access-list 180 permit ip 172.160.160.0 0.0.0.255 172.180.180.0 0.0.0.255 
access-list 190 permit ip 172.160.160.0 0.0.0.255 172.190.190.0 0.0.0.255 
!
dialer-list 1 protocol ip permit
dialer-list 1 protocol ipx permit
!
line con 0
transport input none
line aux 0
line vty 0 4
password ww
login
end
 
   

IPSec Preferred Peer Configuration Examples

The following examples show how to configure an IPSec preferred peer:

Default Peer Configuration Example

IPSec Idle Timer with Default Peer Configuration Example

Default Peer Configuration Example

The following example shows how to configure a default peer. In this example, the first peer, at IP address 1.1.1.1, is the default peer:

Router(config)# crypto map tohub 1 ipsec-isakmp 
Router(config-crypto-map)# set peer 1.1.1.1 default 
Router(config-crypto-map)# set peer 2.2.2.2 
Router(config-crypto-map)# exit

IPSec Idle Timer with Default Peer Configuration Example

The following example shows how to configure an IPSec idle timer with a default peer. In the following example, if the current peer is idle for 600 seconds, the default peer 1.1.1.1 (which was specified in the set peer command) is used for the next attempted connection:

Router (config)# crypto map tohub 1 ipsec-isakmp 
Router(config-crypto-map)# set peer 1.1.1.1 default 
Router(config-crypto-map)# set peer 2.2.2.2 
Router(config-crypto-map)# set security-association idle-time 600 default 
Router(config-crypto-map)# exit

IPSec Security Association Idle Timer Configuration Examples

The following examples show how to configure the IPSec SA idle timer:

IPSec SA Idle Timer Global Configuration Example

IPSec SA Idle Timer per Crypto Map Configuration Example

IPSec SA Idle Timer Global Configuration Example

The following example globally configures the IPSec SA idle timer to drop SAs for inactive peers after 600 seconds:

Router(config)# crypto ipsec security-association idle-time 600

IPSec SA Idle Timer per Crypto Map Configuration Example

The following example configures the IPSec SA idle timer for the crypto map named test to drop SAs for inactive peers after 600 seconds:

Router(config) # crypto map test 1 ipsec-isakmp
Router(config-crypto-map)# set security-association idle-time 600

Distinguished Name-Based Crypto Maps Configuration Example

The following example shows how to configure distinguished name based crypto maps that have been authenticated by DN and hostname. Comments are included inline to explain various commands.

! DN based crypto maps require you to configure an IKE policy at each peer. 
crypto isakmp policy 15 
 encryption 3des 
 hash md5 
 authentication rsa-sig 
 group 2 
 lifetime 5000 
crypto isakmp policy 20 
 authentication pre-share 
 lifetime 10000 
 crypto isakmp key 1234567890 address 171.69.224.33 
! 
!The following is an IPSec crypto map (part of IPSec configuration). It can be used only 
! by peers that have been authenticated by DN and if the certificate belongs to BigBiz. 
crypto map map-to-bigbiz 10 ipsec-isakmp 
 set peer 172.21.114.196 
 set transform-set my-transformset 
 match address 124 
 identity to-bigbiz 
! 
crypto identity to-bigbiz 
dn ou=BigBiz 
! 
! 
! This crypto map can be used only by peers that have been authenticated by hostname 
!and if the certificate belongs to little.com. 
crypto map map-to-little-com 10 ipsec-isakmp 
 set peer 172.21.115.119 
 set transform-set my-transformset 
 match address 125 
 identity to-little-com 
! 
crypto identity to-little-com 
fqdn little.com 
! 

QoS Configuration Example

The following example shows how to configure the dual-priority queue for module QoS:

mls qos
!
Interface GigabitEthernet4/0/1
 mls qos trust cos
 priority-queue cos-map 1 0 1 5
!
Interface GigabitEthernet4/0/2
 mls qos trust cos
 priority-queue cos-map 1 0 1 5
 
   

Deny Policy Enhancements for ACLs Configuration Example

The following example shows a configuration using the deny policy clear option. In this example, when a deny address is hit, the search will stop and traffic will be allowed to pass in the clear (unencrypted) state:

Router(config)# crypto ipsec ipv4-deny clear