-
Cisco IOS Security Command Reference, Release 12.3 T
-
Introduction
-
Security Commands: aaa accounting through access-template
-
Security Commands: accounting through clear ip ips statistics
-
Security Commands: clear ip sdee through crypto isakmp nat keepalive
-
Security Commands: crypto key decrypt rsa through ctype
-
Security Commands: D through evaluate
-
Security Commands: fingerprint through ip ips signature disable
-
Security Commands: ip port-map through issuer name
-
Security Commands: keepalive (isakmp profile) through outgoing
-
Security Commands: parameter through quit
-
Security Commands: radius-server attribute 11 direction default through rsa-pubkey
-
Security Commands: save-password through show crypto ipsec transform-set
-
Security Commands: show crypto isakmp key through subject-name
-
Security Commands: tacacs-server administration through xauth userid mode
-
Table Of Contents
clear ip trigger-authentication
crypto ca certificate query (ca-trustpoint)
crypto ca certificate query (global)
crypto ipsec client ezvpn (global)
crypto ipsec client ezvpn (interface)
crypto ipsec client ezvpn connect
crypto ipsec client ezvpn xauth
crypto ipsec df-bit (interface)
crypto ipsec fragmentation (global)
crypto ipsec fragmentation (interface)
crypto ipsec security-association idle-time
crypto ipsec security-association lifetime
crypto ipsec security-association replay disable
crypto ipsec security-association replay window-size
crypto isakmp aggressive-mode disable
crypto isakmp client configuration address-pool local
crypto isakmp client configuration group
crypto isakmp invalid-spi-recovery
clear ip sdee
To clear Security Device Event Exchange (SDEE) events or subscriptions, use the clear ip sdee command in privileged EXEC mode.
clear ip sdee {events | subscriptions}
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Because subscriptions are properly closed by the Cisco IOS Intrusion Prevention System (IPS) client, this command is typically used only to help with error recovery.
Examples
The following example shows how to clear all open SDEE subscriptions on the router:
Router# clear ip sdee subscriptionsRelated Commands
clear ip trigger-authentication
To clear the list of remote hosts for which automated double authentication has been attempted, use the clear ip trigger-authentication command in privileged EXEC mode.
clear ip trigger-authentication
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use this command when troubleshooting automated double authentication. This command clears the entries in the list of remote hosts displayed by the show ip trigger-authentication command.
Examples
The following example clears the remote host table:
Router# show ip trigger-authenticationTrigger-authentication Host Table:Remote Host Time Stamp172.21.127.114 2940514234Router# clear ip trigger-authenticationRouter# show ip trigger-authenticationRelated Commands
show ip trigger-authentication
Displays the list of remote hosts for which automated double authentication has been attempted.
clear ip urlfilter cache
To clear the cache table, use the clear ip urlfilter cache command in user EXEC mode.
clear ip urlfilter cache {ip-address | all} [vrf vrf-name]
Syntax Description
Command Modes
User EXEC
Command History
12.2(11)YU
This command was introduced.
12.2(15)T
This command was integrated into Cisco IOS Release 12.2(15)T.
12.3(14)T
The vrf vrf-name keyword/argument pair was added.
Usage Guidelines
The cache table consists of the most recently requested IP addresses and the respective authorization status for each IP address.
Examples
The following example shows how to clear the cache table of IP address 172.18.139.21:
clear ip urlfilter cache 172.18.139.21The following example shows how to clear the cache table of all IP addresses:
clear ip urlfilter cache allThe following example shows how to clear the cache table of all IP addresses in the vrf named bank.
clear ip urlfilter cache all vrf bankRelated Commands
ip urlfilter cache
Configures cache parameters.
show ip urlfilter cache
Displays the destination IP addresses that are cached into the cache table.
clear kerberos creds
To delete the contents of the credentials cache, use the clear kerberos creds command in privileged EXEC mode.
clear kerberos creds
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Credentials are deleted when this command is issued.
Cisco supports Kerberos 5.
Examples
The following example illustrates the clear kerberos creds command:
Router# show kerberos credsDefault Principal: chet@cisco.comValid Starting Expires Service Principal18-Dec-1995 16:21:07 19-Dec-1995 00:22:24 krbtgt/CISCO.COM@CISCO.COMRouter# clear kerberos credsRouter# show kerberos credsNo Kerberos credentials.Related Commands
clear radius local-server
To clear the display on the local server or to unblock a locked username, use the clear radius local-server command in privileged EXEC mode.
clear radius local-server {statistics | user username}
Syntax Description
statistics
Clears the display of statistical information.
user
Unblocks the locked username specified.
username
Locked username.
Command Modes
Privileged EXEC
Command History
Examples
The following example unblocks the locked username "smith":
Router# clear radius local-server user smithRelated Commands
clid
To preauthenticate calls on the basis of the Calling Line Identification (CLID) number, use the clid command in AAA preauthentication configuration mode. To remove the clid command from your configuration, use the no form of this command.
clid [if-avail | required] [accept-stop] [password password]
no clid [if-avail | required] [accept-stop] [password password]
Syntax Description
Defaults
The if-avail and required keywords are mutually exclusive. If the if-avail keyword is not configured, the preauthentication setting defaults to required.
The default password string is cisco.
Command Modes
AAA preauthentication configuration
Command History
Usage Guidelines
You may configure more than one of the authentication, authorization and accounting (AAA) preauthentication commands (clid, ctype, dnis) to set conditions for preauthentication. The sequence of the command configuration decides the sequence of the preauthentication conditions. For example, if you configure dnis, then clid, then ctype, in this order, then this is the order of the conditions considered in the preauthentication process.
In addition to using the preauthentication commands to configure preauthentication on the Cisco router, you must set up the preauthentication profiles on the RADIUS server.
Examples
The following example specifies that incoming calls be preauthenticated on the basis of the CLID number:
aaa preauthgroup radiusclid requiredRelated Commands
client authentication list
To configure Internet Key Exchange (IKE) extended authentication (Xauth) in an Internet Security Association and Key Management Protocol (ISAKMP) profile, use the client authentication list command in ISAKMP profile configuration mode. To restore the default behavior, which is that Xauth is not enabled, use the no form of this command.
client authentication list list-name
no client authentication list list-name
Syntax Description
Defaults
No default behaviors or values
Command Modes
ISAKMP profile configuration
Command History
Usage Guidelines
Before configuring Xauth, you must set up an authentication list using AAA commands.
Xauth can be enabled on a profile basis if it has been disabled globally.
Examples
The following example shows that user authentication is configured. User authentication is a list of authentication methods called "xauthlist" in an ISAKMP profile called "vpnprofile."
crypto isakmp profile vpnprofileclient authentication list xauthlistThe following example shows that Xauth has been disabled globally and enabled for the profiles "vpn-login" and "isakmpauth":
no crypto xauth FastEthernet0/0!crypto isakmp policy 1encr 3desgroup 2!crypto isakmp policy 10encr 3desauthentication pre-sharegroup 2crypto isakmp client configuration group HRZcrypto isakmp client configuration group vpngroupkey cisco123pool vpnpoolcrypto isakmp profile cert_sigmatch identity group HRZisakmp authorization list isakmpauthclient configuration address respondclient configuration group HRZcrypto isakmp profile nocertsmatch identity group vpngroupclient authentication list vpn-loginisakmp authorization list isakmpauthclient configuration address respondRelated Commands
client configuration address
To configure Internet Key Exchange (IKE) configuration mode in the Internet Security Association and Key Management Protocol (ISAKMP) profile, use the client configuration address command in ISAKMP profile configuration mode. To disable IKE configuraton mode, use the no form of this command.
client configuration address {initiate | respond}
no client configuration address {initiate | respond}
Syntax Description
initiate
Router will attempt to set IP addresses for each peer.
respond
Router will accept requests for IP addresses from any requesting peer.
Defaults
IKE configuration is not enabled.
Command Modes
ISAKMP profile configuration
Command History
Usage Guidelines
Before you can use this command, you must enter the crypto isakmp profile command.
Examples
The following example shows that IKE mode is configured to either initiate or respond in an ISAKMP profile called "vpnprofile":
crypto isakmp profile vpnprofileclient configuration address initiateclient configuration address respondRelated Commands
client configuration group
To associate a group with the peer that has been assigned an Internet Security Association Key Management Protocol (ISAKMP) profile, use the client configuration group command in crypto ISAKMP profile configuration mode. To disable this option, use the no form of this command.
client configuration group group-name
no client configuration group group-name
Syntax Description
Defaults
No default behavior or values
Command Modes
Crypto ISAKMP profile configuration
Command History
Usage Guidelines
The client configuration group command is used after the crypto map has been configured and the ISAKMP profiles have been assigned to them.
Examples
The following example shows that the group "some_group" is to be associated with the peer:
crypto isakmp profile id_profileca trust-point 2315match identity host domain cisco.comclient configuration group some_groupRelated Commands
match certificate (ISAKMP)
Assigns an ISAKMP profile to a peer on the basis of the contents of arbitrary fields in the certificate.
commands (view)
To add commands or an interface to a command-line interface (CLI) view, use the commands command in view configuration mode. To delete a command or an interface from a CLI view, use the no form of this command.
Syntax for Adding and Deleting Commands to a View
commands parser-mode {include | include-exclusive | exclude} [all] [command]
no commands parser-mode {include | include-exclusive | exclude} [all] [command]
Syntax for Adding and Deleting Interfaces to a View
commands parser-mode {include | include-exclusive} [all] [interface interface-name] [command]
no commands parser-mode {include | include-exclusive} [all] [interface interface-name] [command]
Syntax Description
parser-mode
Mode in which the specified command exists. See Table 15 in the "Usage Guidelines" section for a list of available options for this argument.
include
Adds a specified command or a specified interface to the view and allows the same command or interface to be added to an additional view.
include-exclusive
Adds a specified command or a specified interface to the view and excludes the same command or interface from being added to all other views.
exclude
Denies access to commands in the specified parser mode.
Note
This keyword is available only for command-based views.
all
(Optional) A "wildcard" that allows every command in a specified configuration mode that begins with the same keyword or every subinterface within a specified interface to be part of the view.
interface interface-name
(Optional) Interface that is added to the view.
command
(Optional) Command that is added to the view.
Note
Defaults
If this command is not enabled, a view will not have adequate information to deny or allow access to users.
Command Modes
View configuration
Command History
12.3(7)T
This command was introduced.
12.3(11)T
The exclude keyword and the interface interface-name option were added.
Usage Guidelines
If a network administrator does not enter a specific command (via the command argument) or interface (via the interface interface-name option), users are granted access (via the include or include-exclusive keywords) or denied access (via the exclude keyword) to all commands within the specified parser-mode.
parser-mode Options
Table 15 shows some of the keyword options for the parser-mode argument in the commands command. The available mode keywords vary depending on your hardware and software version. To see a list of available mode options on your system, use the commands ? command.
Examples
The following example shows how to add the privileged EXEC command show version to both CLI views "first" and "second." Because the include keyword was issued, the show version command can be added to both views.
Router(config)# parser view firstRouter(config-view)# password 5 secretRouter(config-view)# commands exec include show version!Router(config)# parser view secondRouter(config-view)# password 5 myviewRouter(config-view)# commands exec include show versionThe following example shows how to allow users in the view "first" to execute all commands that start with the word "show" except the show interfaces command, which is excluded by the view "second":
Router(config)# parser view firstRouter(config-view)# password 5 secretRouter(config-view)# commands exec include all show!Router(config)# parser view secondRouter(config-view)# password 5 myviewRouter(config-view)# commands exec include-exclusive show interfacesRelated Commands
parser view
Creates or changes a CLI view and enters view configuration mode.
password 5
Associates a CLI view or a superview with a password.
content-length
To permit or deny HTTP traffic through the firewall on the basis of message size, use the content-length command in appfw-policy-http configuration mode. To remove message-size limitations from your configuration, use the no form of this command.
content-length {min bytes max bytes | min bytes | max bytes} action {reset | allow} [alarm]
no content-length {min bytes max bytes | min bytes | max bytes} action {reset | allow} [alarm]
Syntax Description
Defaults
If this command is not enabled, message size is not considered when permitting or denying HTTP messages.
Command Modes
appfw-policy-http configuration
Command History
Usage Guidelines
All messages exceeding the specified content-length range, will be subjected to the configured action (reset or allow).
Examples
The following example, which shows how to define the HTTP application firewall policy "mypolicy," will not permit HTTP messages longer than 1 byte. This policy includes all supported HTTP policy rules. After the policy is defined, it is applied to the inspection rule "firewall," which will inspect all HTTP traffic entering the FastEthernet0/0 interface.
! Define the HTTP policy.appfw policy-name mypolicyapplication httpstrict-http action allow alarmcontent-length max 1 action allow alarmcontent-type-verification match-req-resp action allow alarmmax-header-length request 1 response 1 action allow alarmmax-uri-length 1 action allow alarmport-misuse default action allow alarmrequest-method rfc default action allow alarmrequest-method extension default action allow alarmtransfer-encoding type default action allow alarm!!! Apply the policy to an inspection rule.ip inspect name firewall appfw mypolicyip inspect name firewall http!!! Apply the inspection rule to all HTTP traffic entering the FastEthernet0/0 interface.interface FastEthernet0/0ip inspect firewall in!!content-type-verification
To permit or deny HTTP traffic through the firewall on the basis of content message type, use the content-type-verification command in appfw-policy-http configuration mode. To disable this inspection parameter, use the no form of this command.
content-type-verification [match-req-resp] action {reset | allow} [alarm]
no content-type-verification [match-req-resp] action {reset | allow} [alarm]
Syntax Description
Defaults
If this command is not issued, all traffic will be allowed.
Command Modes
appfw-policy-http configuration
Command History
Usage Guidelines
After the content-type-verification command is issued, all HTTP messages are subjected to the following inspections:
•
•
Table 16 contains a list of supported content types.
Examples
The following example shows how to define the HTTP application firewall policy "mypolicy." This policy includes all supported HTTP policy rules. After the policy is defined, it is applied to the inspection rule "firewall," which will inspect all HTTP traffic entering the FastEthernet0/0 interface.
! Define the HTTP policy.appfw policy-name mypolicyapplication httpstrict-http action allow alarmcontent-length max 1 action allow alarmcontent-type-verification match-req-resp action allow alarmmax-header-length request 1 response 1 action allow alarmmax-uri-length 1 action allow alarmport-misuse default action allow alarmrequest-method rfc default action allow alarmrequest-method extension default action allow alarmtransfer-encoding type default action allow alarm!!! Apply the policy to an inspection rule.ip inspect name firewall appfw mypolicyip inspect name firewall http!!! Apply the inspection rule to all HTTP traffic entering the FastEthernet0/0 interface.interface FastEthernet0/0ip inspect firewall in!!copy ips-sdf
To load or save the signature definition file (SDF) in the router, use the copy ips-sdf command in EXEC mode.
Syntax for Loading the SDF
copy [/erase] url ips-sdf
Syntax for Saving the SDF
copy ips-sdf url
Syntax Description
Command Modes
EXEC
Command History
Usage Guidelines
Loading Signatures From the SDF
Issue the copy url ips-sdf command to load the SDF in the router from the location specified via the url argument. When the new SDF is loaded, it is merged with the SDF that is already loaded in the router, unless the /erase keyword is issued, which overwrites the current SDF with the new SDF.
Cisco IOS Intrusion Prevention System (IPS) will attempt to retrieve the SDF from each specified location in the order in which they were configured in the startup configuration. If Cisco IOS IPS cannot retrieve the signatures from any of the specified locations, the built-in signatures will be used.
If the no ip ips sdf built-in command is used, Cisco IOS IPS will fail to load. IPS will then rely on the configuration of the ip ips fail command to either fail open or fail closed.
Note
After the signatures are loaded in the router, the signature engines are built. Only after the signature engines are built can Cisco IOS IPS beginning scanning traffic.
Note
Depending on your platform and how many signatures are being loaded, building the engine can take up to several minutes. It is recommended that you enable logging messages to monitor the engine building status.The ip sdf ips location command can also be used to load the SDF. However, unlike the copy ips-sdf command, this command does not force and immediately load the signatures. Signatures are not loaded until the router reboots or IPS is initially applied to an interface (via the ip ips command).
Saving a Generated or Merges SDF
Issue the copy ips-sdf url command to save a newly created SDF file to a specified location. The next time the router is reloaded, IPS can refer to the SDF from the saved location by including the ip ips sdf location command in the configuration.
Tip
Examples
The following example shows how to configure the router to load and merge the attack-drop.sdf file with the default signatures. After you have merged the two files, it is recommended to copy the newly merged signatures to a separate file. The router can then be reloaded (via the reload command) or reinitalized to so as to recognize the newly merged file (as shown the following example)
!ip ips name MYIPS!interface GigabitEthernet0/1ip address 10.1.1.16 255.255.255.0ip ips MYIPS induplex fullspeed 100media-type rj45no negotiation auto!!! Merge the flash-based SDF (attack-drop.sdf) with the built-in signatures.copy disk2:attack-drop.sdf ips-sdf! Save the newly merged signatures to a separate file.copy ips-sdf disk2:my-signatures.sdf!! Configure the router to use the new file, my-signatures.sdfconfigure terminalip ips sdf location disk2:my-signatures.sdf! Reinitialize the IPS by removing the IPS rule set and reapplying the rule set.interface gig 0/1no ip ips MYIPS in!*Apr 8 14:05:38.243:%IPS-2-DISABLED:IPS removed from all interfaces - IPS disabled!ip ips MYIPS in!exit
Related Commands
ip ips sdf location
Specifies the location in which the router should load the SDF.
crl best-effort
Note
To download the certificate revocation list (CRL) but accept certificates if the CRL is not available, use the crl best-effort command in ca-identity configuration mode. To return to the default behavior in which CRL checking is mandatory before your router can accept a certificate, use the no form of this command.
Syntax Description
This command has no arguments or keywords.
Defaults
If this command is not configured, CRL checking is mandatory before your router can accept a certificate. That is, if CRL downloading is attempted and it fails, the certificate will be considered invalid and will be rejected.
Command Modes
Ca-identity configuration
Command History
12.2(8)T
This command was introduced.
12.3(2)T
This command was replaced by the revocation-check command.
Usage Guidelines
When your router receives a certificate from a peer, it will search its memory for the appropriate CRL. If the appropriate CRL is in the router memory, the CRL will be used. Otherwise, the router will download the CRL from either the certificate authority (CA) or from a CRL distribution point (CDP) as designated in the certificate of the peer. Your router will then check the CRL to ensure that the certificate that the peer sent has not been revoked. (If the certificate appears on the CRL, your router will not accept the certificate and will not authenticate the peer.)
When a CA system uses multiple CRLs, the certificate of the peer will indicate which CRL applies in its CDP extension and should be downloaded by your router.
If your router does not have the applicable CRL in memory and is unable to obtain one, your router will reject the certificate of the peer—unless you include the crl best-effort command in your configuration. When the crl best-effort command is configured, your router will try to obtain a CRL, but if it cannot obtain a CRL, it will treat the certificate of the peer as not revoked.
When your router receives additional certificates from peers, the router will continue to attempt to download the appropriate CRL if it was previously unsuccessful. The crl best-effort command specifies only that when the router cannot obtain the CRL, the router will not be forced to reject the certificate of a peer.
Examples
The following configuration example declares a CA and permits your router to accept certificates when CRLs are not obtainable:
crypto ca identity myidenrollment url http://mycaservercrl best-effortRelated Commands
crl optional
Note
To allow the certificates of other peers to be accepted without trying to obtain the appropriate CRL, use the crl optional command in ca-identity configuration mode. To return to the default behavior in which CRL checking is mandatory before your router can accept a certificate, use the no form of this command.
crl optional
no crl optional
Syntax Description
This command has no arguments or keywords.
Defaults
The router must have and check the appropriate CRL before accepting the certificate of another IP Security peer.
Command Modes
Ca-identity configuration
Command History
11.3 T
This command was introduced.
12.3(2)T
This command was replaced by the revocation-check command.
Usage Guidelines
When your router receives a certificate from a peer, it will search its memory for the appropriate CRL. If the router finds the appropriate CRL, that CRL will be used. Otherwise, the router will download the CRL from either the certificate authority (CA) or from a CRL distribution point (CDP) as designated in the certificate of the peer. Your router will then check the CRL to ensure that the certificate that the peer sent has not been revoked. (If the certificate appears on the CRL, your router will not accept the certificate and will not authenticate the peer.) To instruct the router not to download the CRL and treat the certificate as not revoked, use the crl optional command.
Note
Examples
The following example declares a CA and permits your router to accept certificates without trying to obtain a CRL. This example also specifies a nonstandard retry period and retry count.
crypto ca identity mycaenrollment url http://ca_serverenrollment retry-period 20enrollment retry-count 100crl optionalRelated Commands
crl query
If you have to query the certificate revocation list (CRL) to ensure that the certificate of the peer has not been revoked and you have to provide the Lightweight Directory Access Protocol (LDAP) server information, use the crl query command in ca-trustpoint configuration mode. To return to the default behavior, assuming that the CRL distribution point (CDP) has a complete LDAP URL, use no form of this command.
crl query ldap://hostname:[port]
no crl query ldap://hostname:[port]
Syntax Description
Defaults
Not enabled. If crl query ldap://hostname:[port] is not enabled, the router assumes that the CDP that is embedded in the certificate is a complete URL (for example, ldap:myldap.cisco.com/CN=myCA,O=Cisco) and uses it to download the CRL.
If the port number is not configured, the default LDAP server port 389 will be used.
Command Modes
Ca-trustpoint configuration
Command History
12.1(1)T
This command was introduced.
12.2(8)T
This command replaced the query url command.
Usage Guidelines
When Cisco IOS software tries to verify a peer certificate (for example, during Internet Key Exchange [IKE] or Secure Sockets Layer [SSL] handshake), it queries the CRL to ensure that the certificate has not been revoked. To locate the CRL, it first looks for the CDP extension in the certificate. If the extension exists, it is used to download the CRL. Otherwise, the Simple Certificate Enrollment Protocol (SCEP) GetCRL mechanism is used to query the CRL from the CA server directly (some CA servers do not support this method).
Cisco IOS software supports three types of CDP:
•
•
•
To locate the CRL, a complete URL needs to be formed. As a result, Example 3 and Example 4 still require the hostname and the port number. The ldap://hostname:[port} keywords and arguments are used to provide this information.
Note
Examples
The following example shows how to configure your router to query the CRL with the LDAP URL that is published by the CA named "bar":
crypto ca trustpoint mytpenrollment url http://bar.cisco.comcrl query ldap://bar.cisco.com:3899Related Commands
crypto ca trustpoint
Declares the CA that your router should use.
revocation-check
Checks the revocation status of a certificate.
crypto ca authenticate
Note
To authenticate the certification authority (by getting the certificate of the CA), use the crypto ca authenticate command in global configuration mode.
crypto ca authenticate name
Syntax Description
name
Specifies the name of the CA. This is the same name used when the CA was declared with the crypto ca identity command.
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
This command is required when you initially configure CA support at your router.
This command authenticates the CA to your router by obtaining the self-signed certificate of the CA that contains the public key of the CA. Because the CA signs its own certificate, you should manually authenticate the public key of the CA by contacting the CA administrator when you perform this command.
If you are using RA mode (using the enrollment mode ra command) when you issue the crypto ca authenticate command, then registration authority signing and encryption certificates will be returned from the CA as well as the CA certificate.
This command is not saved to the router configuration. However. the public keys embedded in the received CA (and RA) certificates are saved to the configuration as part of the RSA public key record (called the "RSA public key chain").
Note
error retrieving certificate :incomplete chain
If you receive an error message similar to this one, check the expiration date of your CA certificate. If the expiration date of your CA certificate is set after the year 2049, you must reduce the expiration date by a year or more.Examples
In the following example, the router requests the certificate of the CA. The CA sends its certificate and the router prompts the administrator to verify the certificate of the CA by checking the CA certificate's fingerprint. The CA administrator can also view the CA certificate's fingerprint, so you should compare what the CA administrator sees to what the router displays on the screen. If the fingerprint on the router's screen matches the fingerprint viewed by the CA administrator, you should accept the certificate as valid.
Router(config)# crypto ca authenticate mycaCertificate has the following attributes:Fingerprint: 0123 4567 89AB CDEF 0123Do you accept this certificate? [yes/no] y#Related Commands
crypto ca cert validate
Note
To determine if a trustpoint has been successfully authenticated, a certificate has been requested and granted, and if the certificate is currently valid, use the crypto ca cert validate command in global configuration mode.
crypto ca cert validate trustpoint
Syntax Description
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto ca cert validate command validates the router's own certificate for a given trustpoint. Use this command as a sanity check after enrollment to verify that the trustpoint is properly authenticated, a certificate has been requested and granted for the trustpoint, and that the certificate is currently valid. A certificate is valid if it is signed by the trustpoint certification authority (CA), not expired, and so on.
Examples
The following examples show the possible output from the crypto ca cert validate command:
Router(config)# crypto ca cert validate kaValidation Failed: trustpoint not found for kaRouter(config)# crypto ca cert validate kaValidation Failed: can't get local certificate chainRouter(config)# crypto ca cert validate kaCertificate chain has 2 certificates.Certificate chain for ka is validRouter(config)# crypto ca cert validate kaCertificate chain has 2 certificates.Validation Error: no certs on chainRouter(config)# crypto ca cert validate kaCertificate chain has 2 certificates.Validation Error: unspecified errorRelated Commands
crypto pki trustpoint
Declares the certification authority that the router should use.
show crypto pki trustpoints
Displays the trustpoints that are configured in the router.
crypto ca certificate chain
Note
To enter the certificate chain configuration mode, use the crypto ca certificate chain command in global configuration mode. (You need to be in certificate chain configuration mode to delete certificates.)
crypto ca certificate chain name
Syntax Description
name
Specifies the name of the CA. Use the same name as when you declared the CA using the crypto pki trustpoint command.
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
This command puts you into certificate chain configuration mode. When you are in certificate chain configuration mode, you can delete certificates using the certificate command.
Examples
The following example deletes the router's certificate. In this example, the router had a general-purpose RSA key pair with one corresponding certificate. The show command is used to determine the serial number of the certificate to be deleted.
Router# show crypto ca certificatesCertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Status: AvailableCertificate Serial Number: 0123456789ABCDEF0123456789ABCDEFKey Usage: General PurposeCA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetRouter# configure terminalRrouter(config)# crypto ca certificate chain mycaRouter(config-cert-chain)# no certificate 0123456789ABCDEF0123456789ABCDEF% Are you sure you want to remove the certificate [yes/no]? yes% Be sure to ask the CA administrator to revoke this certificate.Router(config-cert-chain)# exitRelated Commands
crypto ca certificate map
Note
To define certificate-based access control lists (ACLs), use the crypto ca certificate map command in ca-certificate-map configuration mode. To remove the certificate-based ACLs, use the no form of this command.
crypto ca certificate map label sequence-number
no crypto ca certificate map label sequence-number
Syntax Description
Defaults
No default behavior or value.
Command Modes
Ca-certificate-map configuration
Command History
Usage Guidelines
Issuing this command places the router in CA certificate map configuration mode where you can specify several certificate fields together with their matching criteria. The general form of these fields is as follows:
field-name match-criteria match-value
The field-name in the above example is one of the certificate fields. Field names are similar to the names used in the International Telecommunication Union Telecommunication Standardization Sector (ITU-T) X.509 standard. The name field is a special field that matches any subject name or related name field in the certificate, such as the alt-subject-name, subject-name, and unstructured-subject-name fields.
•
•
•
•
•
•
•
Note
The match-criteria in the example is one of the following logical operators:
•
•
•
•
•
•
The match-value is a case-insensitive string or a date.
Examples
The following example shows how to configure a certificate-based ACL that will allow any certificate issued by Cisco Systems to an entity within the cisco.com domain. The label is Cisco, and the sequence is 10.
crypto ca certificate map Cisco 10issuer-name co Cisco Systemsunstructured-subject-name co cisco.comThe following example accepts any certificate issued by Cisco Systems for an entity with DIAL or organizationUnit component ou=WAN. This certificate-based ACL consists of two separate ACLs tied together with the common label Group. Because the check for DIAL has a lower sequence number, it is performed first. Note that the string "DIAL" can occur anywhere in the subjectName field of the certificate, but the string WAN must be in the organizationUnit component.
crypto ca certificate map Group 10issuer-name co Cisco Systemssubject-name co DIALcrypto ca certificate map Group 20issuer-name co Cisco Systemssubject-name co ou=WANCase is ignored in string comparisons; therefore, DIAL in the previous example will match dial, DIAL, Dial, and so on. Also note that the component identifiers (o=, ou=, cn=, and so on) are not required unless it is desirable that the string to be matched occurs in a specific component of the name. (Refer to the ITU-T security standards for more information about certificate fields and components such as ou=.)
If a component identifier is specified in the match string, the exact string, including the component identifier, must appear in the certificate. This requirement can present a problem if more than one component identifier is included in the match string. For example, "ou=WAN,o=Cisco Systems" will not match a certificate with the string "ou=WAN,ou=Engineering,o=Cisco Systems" because the "ou=Engineering" string separates the two desired component identifiers.
To match both "ou=WAN" and "o=Cisco Systems" in a certificate while ignoring other component identifiers, you could use this certificate map:
crypto ca certificate map Group 10subject-name co ou=WANsubject-name co o=CiscoAny space character proceeding or following the equal sign (=) character in component identifiers is ignored. Therefore "o=Cisco" in the proceeding example will match "o = Cisco," "o= Cisco," "o =Cisco," and so on.
Related Commands
crypto ca certificate query (ca-trustpoint)
Note
To specify that certificates should not be stored locally but retrieved from a certification authority (CA) trustpoint, use the crypto ca certificate query command in ca-trustpoint configuration mode. To cause certificates to be stored locally per trustpoint, use the no form of this command.
crypto ca certificate query
no crypto ca certificate query
Syntax Description
This command has no arguments or keywords.
Defaults
CA trustpoints are stored locally in the router's NVRAM.
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
Normally, certain certificates are stored locally in the router's NVRAM, and each certificate uses a moderate amount of memory. To save NVRAM space, you can use this command to put the router into query mode, preventing certificates from being stored locally; instead, they are retrieved from a specified CA trustpoint when needed. This will save NVRAM space but could result in a slight performance impact.
The crypto ca certificate query command is a subcommand for each trustpoint; thus, this command can be disabled on a per-trustpoint basis.
Before you can configure this command, you must enable the crypto pki trustpoint command, which puts you in ca-trustpoint configuration mode.
Note
Examples
The following example shows how to prevent certificates and certificate revocation lists (CRLs) from being stored locally on the router; instead, they are retrieved from the "ka" trustpoint when needed.
crypto ca trustpoint ka...crypto ca certificate queryRelated Commands
crypto ca certificate query (global)
The crypto ca certificate query command in global configuration mode is replaced by the crypto ca certificate query command in ca-trustpoint configuration mode. See the crypto ca certificate query command for more information.
crypto ca crl request
Note
To request that a new certificate revocation list (CRL) be obtained immediately from the certification authority, use the crypto ca crl request command in global configuration mode.
crypto ca crl request name
Syntax Description
name
Specifies the name of the CA. This is the same name used when the CA was declared with the crypto pki trustpoint command.
Defaults
Normally, the router requests a new CRL when it is verifying a certificate and there is no CRL cached.
Command Modes
Global configuration
Command History
11.3 T
This command was introduced.
12.3(7)T
This command was replaced by the crypto pki crl request command.
Usage Guidelines
A CRL lists all the certificates of the network device that have been revoked. Revoked certificates will not be honored by your router; therefore, any IPSec device with a revoked certificate cannot exchange IP Security traffic with your router.
The first time your router receives a certificate from a peer, it will download a CRL from the CA. Your router then checks the CRL to make sure the certificate of the peer has not been revoked. (If the certificate appears on the CRL, it will not accept the certificate and will not authenticate the peer.)
A CRL can be reused with subsequent certificates until the CRL expires. If your router receives the certificate of a peer after the applicable CRL has expired, it will download the new CRL.
If your router has a CRL which has not yet expired, but you suspect that the contents of the CRL are out of date, use the crypto ca crl request command to request that the latest CRL be immediately downloaded to replace the old CRL.
This command is not saved to the configuration.
Note
Examples
The following example immediately downloads the latest CRL to your router:
crypto ca crl requestcrypto ca enroll
Note
To obtain the certificate(s) of your router from the certification authority, use the crypto ca enroll command in global configuration mode. To delete a current enrollment request, use the no form of this command.
crypto ca enroll name
no crypto ca enroll name
Syntax Description
name
Specifies the name of the CA. Use the same name as when you declared the CA using the crypto pki trustpoint command.
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
This command requests certificates from the CA for all of your router's RSA key pairs. This task is also known as enrolling with the CA. (Technically, enrolling and obtaining certificates are two separate events, but they both occur when this command is issued.)
Your router needs a signed certificate from the CA for each RSA key pairs of your router; if you previously generated general purpose keys, this command will obtain the one certificate corresponding to the one general purpose RSA key pair. If you previously generated special usage keys, this command will obtain two certificates corresponding to each of the special usage RSA key pairs.
If you already have a certificate for your keys you will be unable to complete this command; instead, you will be prompted to remove the existing certificate first. (You can remove existing certificates with the no certificate command.)
The crypto ca enroll command is not saved in the router configuration.
Note
Responding to Prompts
When you issue the crypto ca enroll command, you are prompted a number of times.
First, you are prompted to create a challenge password. This password can be up to 80 characters in length. This password is necessary in the event that you ever need to revoke your router's certificate(s). When you ask the CA administrator to revoke your certificate, you must supply this challenge password as a protection against fraudulent or mistaken revocation requests.
Note
If you lose the password, the CA administrator may still be able to revoke the router's certificate but will require further manual authentication of the router administrator identity.
You are also prompted to indicate whether or not your router's serial number should be included in the obtained certificate. The serial number is not used by IP Security or Internet Key Exchange but may be used by the CA to either authenticate certificates or to later associate a certificate with a particular router. (Note that the serial number stored is the serial number of the internal board, not the one on the enclosure.) Ask your CA administrator if serial numbers should be included. If you are in doubt, include the serial number.
Normally, you would not include the IP address because the IP address binds the certificate more tightly to a specific entity. Also, if the router is moved, you would need to issue a new certificate. Finally, a router has multiple IP addresses, any of which might be used with IPSec.
If you indicate that the IP address should be included, you will then be prompted to specify the interface of the IP address. This interface should correspond to the interface that you apply your crypto map set to. If you apply crypto map sets to more than one interface, specify the interface that you name in the crypto map local-address command.
Examples
In the following example, a router with a general-purpose RSA key pair requests a certificate from the CA. When the router displays the certificate fingerprint, the administrator verifies this number by calling the CA administrator, who checks the number. The fingerprint is correct, so the router administrator accepts the certificate.
There can be a delay between when the router administrator sends the request and when the certificate is actually received by the router. The amount of delay depends on the CA method of operation.
Router(config)# crypto ca enroll myca%% Start certificate enrollment ..% Create a challenge password. You will need to verbally provide thispassword to the CA Administrator in order to revoke your certificate.For security reasons your password will not be saved in the configuration.Please make a note of it.Password: <mypassword>Re-enter password: <mypassword>% The subject name in the certificate will be: myrouter.example.com% Include the router serial number in the subject name? [yes/no]: yes% The serial number in the certificate will be: 03433678% Include an IP address in the subject name [yes/no]? yesInterface: ethernet0/0Request certificate from CA [yes/no]? yes% Certificate request sent to Certificate Authority% The certificate request fingerprint will be displayed.% The 'show crypto pki certificates' command will also show the fingerprint.Some time later, the router receives the certificate from the CA and displays the following confirmation message:
Router(config)# Fingerprint: 01234567 89ABCDEF FEDCBA98 75543210%CRYPTO-6-CERTRET: Certificate received from Certificate AuthorityRouter(config)#If necessary, the router administrator can verify the displayed Fingerprint with the CA administrator.
If there is a problem with the certificate request and the certificate is not granted, the following message is displayed on the console instead:
%CRYPTO-6-CERTREJ: Certificate enrollment request was rejected by Certificate AuthorityThe subject name in the certificate is automatically assigned to be the same as the RSA key pair's name. In the above example, the RSA key pair was named "myrouter.example.com." (The router assigned this name.)
Requesting certificates for a router with special usage keys would be the same as the previous example, except that two certificates would have been returned by the CA. When the router received the two certificates, the router would have displayed the same confirmation message:
%CRYPTO-6-CERTRET: Certificate received from Certificate AuthorityRelated Commands
crypto ca export pem
Note
To export certificates and Rivest, Shamir, and Adelman (RSA) keys that are associated with a trustpoint in a privacy-enhanced mail (PEM)-formatted file, use the crypto ca export pem command in global configuration mode.
crypto ca export trustpoint pem {terminal | url url} {3des | des} passphrase
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto ca export pem command allows you to export certificate and RSA key pairs in PEM-formatted files. The PEM files can then be imported back into the Cisco IOS router (via the crypto pki import pem command) or other public key infrastructure (PKI) applications.
Examples
The following example shows how to generate and export the RSA key pair "aaa" and certificates of the router in PEM files that are associated with the trustpoint "mycs":
Router(config)# crypto key generate rsa general-keys label aaa exportableThe name for the keys will be:aaaChoose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.!How many bits in the modulus [512]:% Generating 512 bit RSA keys ...[OK]!Router(config)# crypto pki trustpoint mycsRouter(ca-trustpoint)# enrollment url http://mycsRouter(ca-trustpoint)# rsakeypair aaaRouter(ca-trustpoint)# exitRouter(config)# crypto pki authenticate mycsCertificate has the following attributes:Fingerprint:C21514AC 12815946 09F635ED FBB6CF31% Do you accept this certificate? [yes/no]:yTrustpoint CA certificate accepted.!Router(config)# crypto pki enroll mycs%% Start certificate enrollment ..% Create a challenge password. You will need to verbally provide this password to the CA Administrator in order to revoke your certificate.For security reasons your password will not be saved in the configuration.Please make a note of it.Password:Re-enter password:% The fully-qualified domain name in the certificate will be:Router% The subject name in the certificate will be:bizarro.cisco.com% Include the router serial number in the subject name? [yes/no]:n% Include an IP address in the subject name? [no]:nRequest certificate from CA? [yes/no]:y% Certificate request sent to Certificate Authority% The certificate request fingerprint will be displayed.% The 'show crypto ca certificate' command will also show the fingerprint.Router(config)# Fingerprint: 8DA777BC 08477073 A5BE2403 812DD15700:29:11:%CRYPTO-6-CERTRET:Certificate received from Certificate AuthorityRouter(config)# crypto ca export aaa pem terminal 3des cisco123% CA certificate:-----BEGIN CERTIFICATE-----MIICAzCCAa2gAwIBAgIBATANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJVUzES<snip>waDeNOSI3WlDa0AWq5DkVBkxwgn0TqIJXJOCttjHnWHK1LMcMVGn-----END CERTIFICATE-----% Key name:aaaUsage:General Purpose Key-----BEGIN RSA PRIVATE KEY-----Proc-Type:4,ENCRYPTEDDEK-Info:DES-EDE3-CBC,ED6B210B626BC81AUrguv0jnjwOgowWVUQ2XR5nbzzYHI2vGLunpH/IxIsJuNjRVjbAAUpGk7VnPCT87<snip>kLCOtxzEv7JHc72gMku9uUlrLSnFH5slzAtoC0czfU4=-----END RSA PRIVATE KEY-----% Certificate:-----BEGIN CERTIFICATE-----MIICTjCCAfigAwIBAgICIQUwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMx<snip>6xlBaIsuMxnHmr89KkKkYlU6-----END CERTIFICATE-----Related Commands
crypto ca export pkcs12
Note
To export Rivest, Shamir, and Adelman (RSA) keys within a PKCS12 file at a specified location, use the crypto ca export pkcs12 command in global configuration mode.
crypto ca export trustpointname pkcs12 destination url passphrase
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto ca export pkcs12 command creates a PKCS 12 file that contains an RSA key pair. The PKCS12 file, along with a certificate authority (CA), is exported to the location that you specify with the destination URL. If you decide not to import the file to another router, you must delete the file.
Security Measures
Keep the PKCS12 file stored in a secure place with restricted access.
An RSA keypair is more secure than a passphrase because the private key in the key pair is not known by multiple parties. When you export an RSA key pair to a PKCS#12 file, the RSA key pair now is only as secure as the passphrase.
To create a good passphrase, be sure to include numbers, as well as both lowercase and uppercase letters. Avoid publicizing the passphrase by mentioning it in e-mail or cell phone communications because the information could be accessed by an unauthorized user.
Examples
The following example exports an RSA key pair with a trustpoint name "mytp" to a Flash file:
Router(config)# crypto ca export mytp pkcs12 flash:myexport mycompanyRelated Commands
crypto ca identity
The crypto ca identity command is replaced by the crypto ca trustpoint command. See the crypto ca trustpoint command for more information.
crypto ca import
Note
To import a certificate manually via TFTP or as a cut-and-paste at the terminal, use the crypto ca import command in global configuration mode.
crypto ca import name certificate
Syntax Description
name certificate
Name of the certification authority (CA). This name is the same name used when the CA was declared with the crypto pki trustpoint command.
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
You must enter the crypto ca import command twice if usage keys (signature and encryption keys) are used. The first time the command is entered, one of the certificates is pasted into the router; the second time the command is entered, the other certificate is pasted into the router. (It does not matter which certificate is pasted first.)
Examples
The following example shows how to import a certificate via cut-and-paste. In this example, the CA trustpoint is "MS."
crypto pki trustpoint MSenroll terminalcrypto pki authenticate MS!crypto pki enroll MScrypto ca import MS certificateRelated Commands
crypto ca import pem
Note
To import certificates and Rivest, Shamir, and Adelman (RSA) keys to a trustpoint from privacy-enhanced mail (PEM)-formatted files, use the crypto ca import pem command in global configuration mode.
crypto ca import trustpoint pem [usage-keys] {terminal | url url} [exportable] passphrase
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto ca import pem command allows you import certificates and RSA key pairs in PEM-formatted files. The files can be previously exported from another router or generated from other public key infrastructure (PKI) applications.
Examples
The following example shows how to import PEM files to trustpoint "ggg" via TFTP:
Router(config)# crypto ca import ggg pem url tftp://10.1.1.2/johndoe/msca cisco1234% Importing CA certificate...Address or name of remote host [10.1.1.2]?Destination filename [johndoe/msca.ca]?Reading file from tftp://10.1.1.2/johndoe/msca.caLoading johndoe/msca.ca from 10.1.1.2 (via Ethernet0):![OK - 1082 bytes]% Importing private key PEM file...Address or name of remote host [10.1.1.2]?Destination filename [johndoe/msca.prv]?Reading file from tftp://10.1.1.2/johndoe/msca.prvLoading johndoe/msca.prv from 10.1.1.2 (via Ethernet0):![OK - 573 bytes]% Importing certificate PEM file...Address or name of remote host [10.1.1.2]?Destination filename [johndoe/msca.crt]?Reading file from tftp://10.1.1.2/johndoe/msca.crtLoading johndoe/msca.crt from 10.1.1.2 (via Ethernet0):![OK - 1289 bytes]% PEM files import succeeded.Router(config)#Related Commands
crypto ca import pkcs12
Note
To import Rivest, Shamir, and Adelman (RSA) keys, use the crypto ca import pkcs12 command in global configuration mode.
crypto ca import trustpointname pkcs12 source url passphrase
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
When you enter the cyrpto ca import pkcs12 command, a ke pair and a trustpoint are generated. If you then decide you want to remove the key pair and trustpoint that were generated, enter the crypto key zeroize rsa command to zeroize the key pair and enter the no crypto ca trustpoint command to remove the trustpoint.
Note
Examples
In the following example, an RSA key pair that has been associated with the trustpoint "forward" is to be imported:
Router(config)# crypto ca import forward pkcs12 flash:myexport mycompanyRelated Commands
crypto pki export pkcs12
Exports RSA keys.
crypto pki trustpoint
Declares the CA that your router should use.
crypto key zeroize rsa
Deletes all RSA keys from your router.
crypto ca profile enrollment
Note
To define an enrollment profile, use the crypto ca profile enrollment command in global configuration mode. To delete all information associated with this enrollment profile, use the no form of this command.
crypto ca profile enrollment label
no crypto ca profile enrollment label
Syntax Description
label
Name for the enrollment profile; the enrollment profile name must match the name specified in the enrollment profile command.
Defaults
An enrollment profile does not exist.
Command Modes
Global configuration
Command History
12.2(13)ZH
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
Usage Guidelines
Before entering this command, you must specify a named enrollment profile using the enrollment profile in ca-trustpoint configuration mode.
After entering the crypto ca profile enrollment command, you can use any of the following commands to define the profile parameters:
•
•
•
•
•
•
•
Note
Examples
The following example shows how to define the enrollment profile named "E" and associated profile parameters:
crypto ca trustpoint Entrustenrollment profile Eserialcrypto ca profile enrollment Eauthentication url http://entrust:81authentication command GET /certs/cacert.derenrollment url http://entrust:81/cda-cgi/clientcgi.exeenrollment command POST reference_number=$P2&authcode=$P1&retrievedAs=rawDER&action=getServerCert&pkcs10Request=$REQparameter 1 value aaaa-bbbb-ccccparameter 2 value 5001Related Commands
crypto ca trusted-root
The crypto ca trusted-root command is replaced by the crypto ca trustpoint command. See the crypto ca trustpoint command for more information.
crypto ca trustpoint
Note
To declare the certification authority (CA) that your router should use, use the crypto ca trustpoint command in global configuration mode. To delete all identity information and certificates associated with the CA, use the no form of this command.
crypto ca trustpoint name
no crypto ca trustpoint name
Syntax Description
name
Creates a name for the CA. (If you previously declared the CA and just want to update its characteristics, specify the name you previously created.)
Defaults
Your router does not recognize any CAs until you declare a CA using this command.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the crypto ca trustpoint command to declare a CA, which can be a self-signed root CA or a subordinate CA. Issuing the crypto ca trustpoint command puts you in ca-trustpoint configuration mode.
You can specify characteristics for the trustpoint CA using the following subcommands:
•
•
•
•
•
•
•
Note
The following example shows how to declare the CA named "ka" and specify enrollment and CRL parameters:
crypto ca trustpoint kaenrollment url http://kahului:80The following example shows a certificate-based access control list (ACL) with the label "Group" defined in a crypto ca certificate map command and included in the match certificate subcommand of the crypto ca | pki trustpoint command:
crypto ca certificate map Group 10subject-name co ou=WANsubject-name co o=Cisco!crypto ca trustpoint pkimatch certificate GroupRelated Commands
crypto call admission limit
To specify the maximum number of Internet Key Exchange (IKE) security associations (SAs) that the router can establish before IKE begins rejecting new SA requests, use the crypto call admission limit command in global configuration mode. To disable this feature, use the no form of this command.
crypto call admission limit ike sa number
no crypto call admission limit ike sa number
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to limit the number of IKE SAs permitted to or from a router. By limiting the amount of dynamic tunnels that can be created to the router, you can prevent the router from being overwhelmed if it is suddenly inundated with IKE SA requests. The ideal limit depends on the particular platform, the network topology, the application, and traffic patterns. When the specified limit is reached, IKE rejects all new SA requests. If you specify an IKE SA limit that is less than the current number of active IKE SAs, a warning is displayed, but SAs are not terminated. New SA requests are rejected until the active SA count is below the configured limit.
Examples
The following example specifies that there can be a maximum of 50 IKE SAs before IKE begins rejecting new SA requests.
Router(config)# crypto call admission limit ike sa 50Related Commands
crypto dynamic-map
To create a dynamic crypto map entry and enter the crypto map configuration command mode, use the crypto dynamic-map command in global configuration mode. To delete a dynamic crypto map set or entry, use the no form of this command.
crypto dynamic-map dynamic-map-name dynamic-seq-num
no crypto dynamic-map dynamic-map-name [dynamic-seq-num]
Syntax Description
dynamic-map-name
Specifies the name of the dynamic crypto map set.
dynamic-seq-num
Specifies the number of the dynamic crypto map entry.
Defaults
No dynamic crypto maps exist.
Command Modes
Global configuration.
Command History
Usage Guidelines
Use dynamic crypto maps to create policy templates that can be used when processing negotiation requests for new security associations from a remote IP Security peer, even if you do not know all of the crypto map parameters required to communicate with the remote peer (such as the peer's IP address). For example, if you do not know about all the IPSec remote peers in your network, a dynamic crypto map allows you to accept requests for new security associations from previously unknown peers. (However, these requests are not processed until the Internet Key Exchange authentication has completed successfully.)
When a router receives a negotiation request via IKE from another IPSec peer, the request is examined to see if it matches a crypto map entry. If the negotiation does not match any explicit crypto map entry, it will be rejected unless the crypto map set includes a reference to a dynamic crypto map.
The dynamic crypto map is a policy template; it will accept "wildcard" parameters for any parameters not explicitly stated in the dynamic crypto map entry. This allows you to set up IPSec security associations with a previously unknown IPSec peer. (The peer still must specify matching values for the "non-wildcard" IPSec security association negotiation parameters.)
If the router accepts the peer's request, at the point that it installs the new IPSec security associations it also installs a temporary crypto map entry. This entry is filled in with the results of the negotiation. At this point, the router performs normal processing, using this temporary crypto map entry as a normal entry, even requesting new security associations if the current ones are expiring (based upon the policy specified in the temporary crypto map entry). Once the flow expires (that is, all of the corresponding security associations expire), the temporary crypto map entry is removed.
Dynamic crypto map sets are not used for initiating IPSec security associations. However, they are used for determining whether or not traffic should be protected.
The only configuration required in a dynamic crypto map is the set transform-set command. All other configuration is optional.
Dynamic crypto map entries, like regular static crypto map entries, are grouped into sets. After you define a dynamic crypto map set (which commonly contains only one map entry) using this command, you include the dynamic crypto map set in an entry of the "parent" crypto map set using the crypto map (IPSec global configuration) command. The parent crypto map set is then applied to an interface.
You should make crypto map entries referencing dynamic maps the lowest priority map entries, so that negotiations for security associations will try to match the static crypto map entries first. Only after the negotiation request does not match any of the static map entries do you want it to be evaluated against the dynamic map.
To make a dynamic crypto map the lowest priority map entry, give the map entry referencing the dynamic crypto map the highest seq-num of all the map entries in a crypto map set.
For both static and dynamic crypto maps, if unprotected inbound traffic matches a permit statement in an access list, and the corresponding crypto map entry is tagged as "IPSec," then the traffic is dropped because it is not IPSec-protected. (This is because the security policy as specified by the crypto map entry states that this traffic must be IPSec-protected.)
For static crypto map entries, if outbound traffic matches a permit statement in an access list and the corresponding security association (SA) is not yet established, the router will initiate new SAs with the remote peer. In the case of dynamic crypto map entries, if no SA existed, the traffic would simply be dropped (because dynamic crypto maps are not used for initiating new SAs).
Note
Examples
The following example configures an IPSec crypto map set.
Crypto map entry "mymap 30" references the dynamic crypto map set "mydynamicmap," which can be used to process inbound security association negotiation requests that do not match "mymap" entries 10 or 20. In this case, if the peer specifies a transform set that matches one of the transform sets specified in "mydynamicmap," for a flow "permitted" by the access list 103, IPSec will accept the request and set up security associations with the remote peer without previously knowing about the remote peer. If accepted, the resulting security associations (and temporary crypto map entry) are established according to the settings specified by the remote peer.
The access list associated with "mydynamicmap 10" is also used as a filter. Inbound packets that match a permit statement in this list are dropped for not being IPSec protected. (The same is true for access lists associated with static crypto maps entries.) Outbound packets that match a permit statement without an existing corresponding IPSec SA are also dropped.
crypto map mymap 10 ipsec-isakmpmatch address 101set transform-set my_t_set1set peer 10.0.0.1set peer 10.0.0.2crypto map mymap 20 ipsec-isakmpmatch address 102set transform-set my_t_set1 my_t_set2set peer 10.0.0.3crypto map mymap 30 ipsec-isakmp dynamic mydynamicmap!crypto dynamic-map mydynamicmap 10match address 103set transform-set my_t_set1 my_t_set2 my_t_set3Related Commands
crypto engine accelerator
Note
To enable the onboard hardware accelerator of the router for IP security (IPsec) encryption, use the crypto engine accelerator command in global configuration mode. To disable the use of the onboard hardware IPsec accelerator, and thereby perform IPsec encryption or decryption in software, use the no form of this command.
crypto engine accelerator
no crypto engine accelerator
Syntax Description
This command has no arguments or keywords.
Defaults
The hardware accelerator for IPsec encryption is enabled.
Command Modes
Global configuration
Command History
Usage Guidelines
This command is not normally needed for typical operations because the onboard hardware accelerator of the router is enabled for IPsec encryption by default. The hardware accelerator should not be disabled except on instruction from Cisco Technical Assistance Center (TAC) personnel.
Examples
The following example shows how to disable the onboard hardware accelerator of the router for IPsec encryption. This disabling is normally needed only after the accelerator has been disabled for testing or debugging purposes.
Router(config)# no crypto engine acceleratorWarning! all current connections will be torn down.Do you want to continue? [yes/no]:Related Commands
crypto engine aim
To reenable an advanced integration module (AIM), use the crypto engine aim command in global configuration mode. To disable an AIM encryption module, use the no form of this command.
crypto engine aim aim-slot-number
no crypto engine aim aim-slot-number
Syntax Description
Defaults
An AIM is neither reenabled nor disabled.
Command Modes
Global configuration
Command History
12.3(11)T
This command was introduced. This command replaces the crypto engine accelerator command.
Usage Guidelines
The crypto engine accelerator command will still be usable for a while, but if it is used, only the crypto engine aim command will be saved to the running and startup (nonvolatile memory) configuration.
Examples
The following example shows that the AIM in slot 0 is to be reenabled:
crypto engine aim 0The following example shows that the AIM in slot 0 is to be disabled:
no crypto engine aim 0crypto engine em
To enable the hardware accelerator of an expansion slot for IP security (IPsec) encryption, use the crypto engine em command in global configuration mode. To disable the hardware accelerator of the expansion slot, use the no form of this command.
crypto engine em slot-number
no crypto engine em slot-number
Syntax Description
slot-number
Slot number to which the hardware accelerator of the expansion slot is to be enabled or disabled (applies to slots 0 through 3).
Defaults
The hardware accelerator is neither enabled nor disabled.
Command Modes
Global configuration
Command History
12.3(11)T
This command was introduced. This command replaces the crypto engine accelerator command.
Usage Guidelines
The crypto engine accelerator command will still be usable for a while, but if it is used, only the crypto engine em command will be saved to the running and startup (nonvolatile memory) configuration.
Examples
The following example shows that the hardware accelerator of expansion slot 1 is to be enabled:
crypto engine em 1The following example shows that the hardware accelerator of expansion slot 1 is to be disabled:
no crypto engine em 1crypto engine nm
To enable the onboard hardware accelerator of a network module for IP security (IPsec) encryption, use the crypto engine nm command in global configuration mode. To disable the accelerator of the network module, use the no form of this command.
crypto engine nm slot-number
no crypto engine nm slot-number
Syntax Description
slot-number
Slot number to which the hardware accelerator of a network module is to be enabled or disabled (applies to slots 0 through 5).
Defaults
The hardware accelerator is neither enabled nor disabled.
Command Modes
Global configuration
Command History
12.3(11)T
This command was introduced. This command replaces the crypto engine accelerator command.
Usage Guidelines
The crypto engine accelerator command will still be usable for a while, but if it is used, only the crypto engine nm command will be saved to the running and startup (nonvolatile memory) configuration.
Examples
The following example shows that the hardware accelerator of the network module in slot 0 is to be enabled:
crypto engine nm 0The following example shows that the hardware accelerator of the network module in slot 0 is to be disabled:
no crypto engine nm 0crypto engine onboard
To enable the hardware accelerator of an onboard module for IP security (IPsec) encryption, use the crypto engine onboard command in global configuration mode. To disable the hardware accelerator of the onboard module, use the no form of this command.
crypto engine onboard slot-number
no crypto engine onboard slot-number
Syntax Description
slot-number
Slot number to which the hardware accelerator of the onboard module is to be enabled or disabled (applies to slots 0 and 1).
Defaults
The hardware accelerator is neither enabled nor disabled.
Command Modes
Global configuration
Command History
12.3(11)T
This command was introduced. This command replaces the crypto engine accelerator command.
Usage Guidelines
The crypto engine accelerator command will still be usable for a while, but if it is used, only the crypto engine onboard command will be saved to the running and startup (nonvolatile memory) configuration.
Examples
The following example shows that the hardware accelerator of the onboard module in slot 1 is to be enabled:
crypto engine onboard 1The following example shows that the hardware accelerator of the onboard module in slot 1 is to be disabled:
no crypto engine onboard 1crypto engine slot
To reenable the onboard hardware accelerator in a service adapter, use the crypto engine slot command in global configuration mode. To disable the hardware accelerator in the service adapter, use the no form of this command.
crypto engine slot slot-number
no crypto engine slot slot-number
Syntax Description
slot-number
Slot number to which the hardware accelerator in a service adapter is to be reenabled or disabled (applies to slots 1 through 6).
Defaults
The hardware accelerator is neither enabled nor disabled.
Command Modes
Global configuration
Command History
12.3(11)T
This command was introduced. This command replaces the crypto engine accelerator command.
Usage Guidelines
The crypto engine accelerator command will still be usable for a while, but if it is used, only the crypto engine slot command will be saved to the running and startup (nonvolatile memory) configuration.
Examples
The following example shows that the hardware accelerator of the service adaptor in slot 2is to be enabled:
crypto engine slot 2The following example shows that the hardware accelerator of the service adaptor in slot 2 is to be disabled:
no crypto engine slot 2crypto identity
To configure the identity of the router with a given list of distinguished names (DNs) in the certificate of the router, use the crypto identity command in global configuration mode. To delete all identity information associated with a list of DNs, use the no form of this command.
crypto identity name
no crypto identity name
Syntax Description
Defaults
If this command is not enabled, the IP address is associated with the identity of the router.
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto identity command allows you to configure the identity of a router with a given list of DNs. Thus, when used with the dn and fqdn commands, you can set restrictions in the router configuration that prevent peers with specific certificates, especially certificates with particular DNs, from having access to selected encrypted interfaces.
Note
Examples
The following example shows how to configure a DN-based crypto map:
! The following is an IPSec crypto map (part of IPSec configuration). It can be used only! by peers that have been authenticated by DN and if the certificate belongs to BigBiz.crypto map map-to-bigbiz 10 ipsec-isakmpset peer 172.21.114.196set transform-set my-transformsetmatch address 124identity to-bigbiz!crypto identity to-bigbizdn ou=BigBiz!!! This crypto map can be used only by peers that have been authenticated by hostname! and if the certificate belongs to little.com.crypto map map-to-little-com 10 ipsec-isakmpset peer 172.21.115.119set transform-set my-transformsetmatch address 125identity to-little-com!crypto identity to-little-comfqdn little.com!Related Commands
crypto ipsec client ezvpn (global)
To create a Cisco Easy VPN remote configuration and enter the Cisco Easy VPN remote configuration mode, use the crypto ipsec client ezvpn command in global configuration mode. To delete the Cisco Easy VPN remote configuration, use the no form of this command.
crypto ipsec client ezvpn name
no crypto ipsec client ezvpn name
Note
Syntax Description
Defaults
Newly created Cisco Easy VPN remote configurations default to client mode.
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto ipsec client ezvpn command creates a Cisco Easy VPN remote configuration and then enters the Cisco Easy VPN Remote configuration mode, at which point you can enter the following subcommands:
•
–
–
•
–
–
•
–
–
–
•
•
•
•
–
After specifying the local address used to source tunnel traffic, the IP address can be obtained in two ways:
–
–
•
–
–
–
•
•
The peer subcommand may be input multiple times.
•
–
–
–
The save-password option is useful only if the user password is static, that is, it is not a one-time password (OTP), such as a password generated by a token.
After configuring the Cisco Easy VPN remote configuration, use the exit command to exit the Cisco Easy VPN Remote configuration mode and return to global configuration mode.
Note
Examples
The following example shows a Cisco Easy VPN remote configuration named "telecommuter-client" being created on a Cisco uBR905 or Cisco uBR925 cable access router and being assigned to cable interface 0:
Router# configure terminalRouter(config)# crypto ipsec client ezvpn telecommuter-clientRouter(config-crypto-ezvpn)# group telecommute-group key secret-telecommute-keyRouter(config-crypto-ezvpn)# peer telecommuter-serverRouter(config-crypto-ezvpn)# mode clientRouter(config-crypto-ezvpn)# exitRouter(config)# interface c0Router(config-if)# crypto ezvpn telecommuter-clientRouter(config-if)# exit
Note
The following example shows the Cisco Easy VPN remote configuration named "telecommuter-client" being removed from the interface and then deleted:
Router# configure terminalRouter(config)# interface e1Router(config-if)# no crypto ipsec client ezvpn telecommuter-clientRouter(config-if)# exitRouter(config)# no crypto ipsec client ezvpn telecommuter-clientRelated Commands
crypto ipsec client ezvpn (interface)
Assigns a Cisco Easy VPN Remote configuration to an interface.
crypto ipsec client ezvpn (interface)
To assign a Cisco Easy VPN Remote configuration to an interface, specify whether the interface is outside or inside, and configure multiple outside and inside interfaces, use the crypto ipsec client ezvpn command in interface configuration mode. To remove the Cisco Easy VPN Remote configuration from the interface, use the no form of this command.
crypto ipsec client ezvpn name [outside | inside]
no crypto ipsec client ezvpn name [outside | inside]
Note
Syntax Description
Defaults
The default inside interface is the Ethernet interface on Cisco 800 series routers and Cisco uBR905 and Cisco uBR925 cable access routers.
Command Modes
Interface configuration
Command History
Usage Guidelines
The crypto ipsec client ezvpn command assigns a Cisco Easy VPN Remote configuration to an interface, enabling the creation of a Virtual Private Network (VPN) connection over that interface to the specified VPN peer. If the Cisco Easy VPN Remote configuration is configured for the client mode of operation, this also automatically configures the router for network address translation (NAT) or port address translation (PAT) and for an associated access list.
In Cisco IOS Release 12.2(8)YJ, the crypto ipsec client ezvpn command was enhanced to allow you to configure multiple outside and inside interfaces. To configure multiple outside and inside interfaces, you must use the interface interface-name command to first define the type of interface on the IPSec client router.
•
•
•
The following Cisco IOS Release 12.2(4)YA restrictions apply to the crypto ipsec client ezvpn command:
•
•
For example, on Cisco uBR905 and Cisco uBR925 cable access routers, the outside interface is always the cable interface. On Cisco 1700 series routers, the FastEthernet interface defaults to being the inside interface, so attempting to use the crypto ipsec client ezvpn command on the FastEthernet interface displays an error message.
Note
Examples
The following example shows a Cisco Easy VPN Remote configuration named "telecommuter-client" being assigned to the cable interface on a Cisco uBR905/uBR925 cable access router:
Router# configure terminalRouter(config)# interface c0Router(config-if)# crypto ipsec client ezvpn telecommuter-clientRouter(config-if)# exitThe following example first shows an attempt to delete the Cisco Easy VPN Remote configuration named "telecommuter-client," but the configuration cannot be deleted because it is still assigned to an interface. The configuration is then removed from the interface and deleted.
Router# configure terminalRouter(config)# no crypto ipsec client ezvpn telecommuter-clientError: crypto map in use by interface; cannot deleteRouter(config)# interface e1Router(config-if)# no crypto ipsec client ezvpn telecommuter-clientRouter(config-if)# exitRouter(config)# no crypto ipsec client ezvpn telecommuter-clientRelated Commands
crypto ipsec client ezvpn (global)
Creates and modifies a Cisco Easy VPN Remote configuration.
interface
Configures an interface type.
crypto ipsec client ezvpn connect
To connect to a specified IPSec Virtual Private Network (VPN) tunnel in a manual configuration, use the crypto ipsec client ezvpn connect command in privileged EXEC mode. To disable the connection, use the no form of this command.
crypto ipsec client ezvpn connect name
no crypto ipsec client ezvpn connect name
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command is used with the connect [auto | manual | acl] subcommand. After the manual setting is designated, the Cisco Easy VPN remote waits for a command or application programming interface (API) call before attempting to establish the Cisco Easy VPN remote connection.
If the configuration is manual, the tunnel is connected only after the crypto ipsec client ezvpn connect name command is entered in privileged EXEC mode, and after the connect [auto] | manual subcommand is entered.
Examples
The following example shows how to connect an IPSec VPN tunnel named ISP-tunnel on a Cisco uBR905/uBR925 cable access router:
Router# crypto ipsec client ezvpn connect ISP-tunnelRelated Commands
connect
Manually establishes and terminates an IPSec VPN tunnel on demand.
crypto ipsec client ezvpn (global)
Creates and modifies a Cisco Easy VPN remote configuration.
crypto ipsec client ezvpn xauth
To respond to a pending Virtual Private Network (VPN) authorization request, use the crypto ipsec client ezvpn xauth command in privileged EXEC mode.
crypto ipsec client ezvpn xauth name
Syntax Description
name
Identifies the IP Security (IPSec) VPN tunnel with a unique, arbitrary name. This name is required.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
If the tunnel name is not specified, the authorization request is made on the active tunnel. If there is more than one active tunnel, the command fails with an error requesting that you specify the tunnel name.
When making a VPN connection, individual users might also be required to provide authorization information, such as a username or password. When the remote end requires this information, the router displays a message on the console of the router instructing the user to enter the crypto ipsec client ezvpn xauth command. The user then uses command-line interface (CLI) to enter this command and to provide the information requested by the prompts that follow after the command has been entered.
Note
Examples
The following example shows an example of the user being prompted to enter the crypto ipsec client ezvpn xauth command. The user then enters the requested information and continues.
Router#20:27:39: EZVPN: Pending XAuth Request, Please enter the following command:20:27:39: EZVPN: crypto ipsec client ezvpn xauthRouter> crypto ipsec client ezvpn xauthEnter Username and Password: useridPassword: ************Related Commands
crypto ipsec client ezvpn (interface)
Assigns a Cisco Easy VPN Remote configuration to an interface.
crypto ipsec df-bit (global)
To set the DF bit for the encapsulating header in tunnel mode to all interfaces, use the crypto ipsec df-bit command in global configuration mode.
crypto ipsec df-bit [clear | set | copy]
Syntax Description
Defaults
The default is copy.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the crypto ipsec df-bit command in global configuration mode to configure your router to specify the DF bit in an encapsulated header.
You may want use the clear setting for the DF bit when encapsulating tunnel mode IPSec traffic so you can send packets larger than the available maximum transmission unit (MTU) size or if you do not know what the available MTU size is.
If this command is enabled without a specified setting, the router will use the copy setting as the default.
Examples
The following example shows how to clear the DF bit on all interfaces:
crypto ipsec df-bit clearcrypto ipsec df-bit (interface)
To set the DF bit for the encapsulating header in tunnel mode to a specific interface, use the crypto ipsec df-bit command in interface configuration mode.
crypto ipsec df-bit [clear | set | copy]
Syntax Description
Defaults
The default is copy.
Command Modes
Interface configuration
Command History
Usage Guidelines
Use the crypto ipsec df-bit command in interface configuration mode to configure your router to specify the DF bit in an encapsulated header. This command overrides any existing DF bit global settings.
You may want use the clear setting for the DF bit when encapsulating tunnel mode IPSec traffic so you can send packets larger than the available maximum transmission unit (MTU) size or if you do not know what the available MTU size is.
If this command is enabled without a specified setting, the router will use the copy setting as default.
Examples
In following example, the router is configured to globally clear the setting for the DF bit and copy the DF bit on the interface named Ethernet0. Thus, all interfaces except Ethernet0 will allow the router to send packets larger than the available MTU size; Ethernet0 will allow the router to fragment the packet.
crypto isakmp policy 1hash md5authentication pre-sharecrypto isakmp key Delaware address 192.168.10.66crypto isakmp key Key-What-Key address 192.168.11.19!!crypto ipsec transform-set BearMama ah-md5-hmac esp-descrypto ipsec df-bit clear!!crypto map armadillo 1 ipsec-isakmpset peer 192.168.10.66set transform-set BearMamamatch address 101!crypto map basilisk 1 ipsec-isakmpset peer 192.168.11.19set transform-set BearMamamatch address 102!!interface Ethernet0ip address 192.168.10.38 255.255.255.0ip broadcast-address 0.0.0.0media-type 10BaseTcrypto map armadillocrypto ipsec df-bit copy!interface Ethernet1ip address 192.168.11.75 255.255.255.0ip broadcast-address 0.0.0.0media-type 10BaseTcrypto map basilisk!interface Serial0no ip addressip broadcast-address 0.0.0.0no ip route-cacheno ip mroute-cachecrypto ipsec fragmentation (global)
To enable prefragmentation for IP Security (IPSec) Virtual Private Networks (VPNs) on a global basis, use the crypto ipsec fragmentation command in global configuration mode. To disable a manually configured command, use the no form of this command.
crypto ipsec fragmentation {before-encryption | after-encryption}
no crypto ipsec fragmentation {before-encryption | after-encryption}
Syntax Description
before-encryption
Enables prefragmentation for IPSec VPNs. The default is that prefragmentation is enabled.
after-encryption
Disables prefragmentation for IPSec VPNs.
Command Default
If you do not enter this command, prefragmentation is enabled.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the before-encryption keyword to enable prefragmentation for IPSec VPNs; use the after-encryption keyword to disable prefragmentation for IPSec VPNs. This command allows an encrypting router to predetermine the encapsulated packet size from information available in transform sets, which are configured as part of the IPSec security association (SA). If it is predetermined that the packet will exceed the maximum transmission unit (MTU) of the output interface, the packet is fragmented before encryption.
Note
Examples
The following example shows how to globally enable prefragmentation for IPSec VPNs:
crypto ipsec fragmentation before-encryptioncrypto ipsec fragmentation (interface)
To enable prefragmentation for IP Security (IPSec) Virtual Private Networks (VPNs) on an interface, use the crypto ipsec fragmentation command in interface configuration mode. To disable a manually configured command, use the no form of this command.
crypto ipsec fragmentation {before-encryption | after-encryption}
no crypto ipsec fragmentation {before-encryption | after-encryption}
Syntax Description
before-encryption
Enables prefragmentation for IPSec VPNs.
after-encryption
Disables prefragmentation for IPSec VPNs.
Defaults
If no other prefragmentation for IPSec VPNs commands are in the configuration, the router will revert to the default global configuration.
Command Modes
Interface configuration
Command History
12.1(11b)E
This command was introduced.
12.2(13)T
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
Use the before-encryption keyword to enable prefragmentation for IPSec VPNs per interface; use the after-encryption keyword to disable prefragmentation for IPSec VPNs. This command allows an encrypting router to predetermine the encapsulated packet size from information available in transform sets, which are configured as part of the IPSec security association (SA). If it is predetermined that the packet will exceed the maximum transmission unit (MTU) of output interface, the packet is fragmented before encryption.
Examples
The following example shows how to enable prefragmentation for IPSec VPNs on an interface and then how to display the output of the show running configuration command:
Note
Router(config-if)# crypto ipsec fragmentation before-encryptionRouter(config-if)# exitRouter# show running-configcrypto isakmp policy 10authentication pre-sharecrypto isakmp key abcd123 address 209.165.202.130!crypto ipsec transform-set fooprime esp-3des esp-sha-hmac!crypto map bar 10 ipsec-isakmpset peer 209.165.202.130set transform-set fooprimematch address 102crypto ipsec nat-transparency
To enable security parameter index (SPI) matching or User Datagram Protocol (UDP) encapsulation between two Virtual Private Network (VPN) devices, use the crypto ipsec nat-transparency command on both devices in global configuration mode. To disable both SPI matching and UDP encapsulation, use the no form of this command with each keyword.
crypto ipsec nat-transparency {spi-matching | udp-encaps}
no crypto ipsec nat-transparency {spi-matching | udp-encaps}
Syntax Description
spi-matching
Enables SPI matching on both endpoints.
udp-encaps
Enables UDP encapsulation on both endpoints.
Defaults
When this command is entered, UDP encapsulation is enabled by default.
Command Modes
Global configuration
Command History
12.2(13)T
This command was introduced.
12.2(15)T
The command syntax was modified to add the spi-matching keyword.
Usage Guidelines
You can use this command to resolve issues that arise when Network Address Translation (NAT) is configured in an IP Security (IPsec)-aware network. This command has two mutually exclusive options:
•
•
When you enter the crypto ipsec nat-transparency command, UDP encapsulation is configured unless you either specifically disable it or configure SPI matching. You can disable both options, but doing so might cause problems if the device you are configuring uses NAT and is part of a VPN.
To disable SPI matching, configure UDP encapsulation or use the no form of this command with the keyword spi-matching. To disable UDP encapsulation, configure SPI matching or use the no form of this command with the keyword udp-encaps. To disable both SPI matching and UDP encapsulation, first disable UDP encapsulation, and then disable SPI matching. If you disable both options, the show running-config command displays: no crypto ipsec nat-transparency udp-encaps.
Examples
The following example enables SPI matching on the endpoint routers:
crypto ipsec nat-transparency spi-matchingRelated Commands
crypto ipsec optional
To enable IP Security (IPSec) passive mode, use the crypto ipsec optional command in global configuration mode. To disable IPSec passive mode, use the no form of this command.
crypto ipsec optional
no crypto ipsec optional
Syntax Description
This command has no arguments or keywords.
Defaults
IPSec passive mode is not enabled.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the crypto ipsec optional command to implement an intermediate mode (IPSec passive mode) that allows a router to accept unencrypted and encrypted data. IPSec passive mode is valuable for users who wish to migrate existing networks to IPSec because all routers will continue to interact with routers that encrypt data (that is, that have been upgraded with IPSec) and also with routers that have yet to be upgraded.
After this feature is disabled, all active connections that are sending unencrypted packets are cleared, and a message that reminds the user to enter the write memory command is sent.
Note
Examples
The following example shows how to enable IPSec passive mode:
crypto map xauthmap 10 ipsec-isakmpset peer 209.165.202.145set transform-set xauthtransformmatch address 192!crypto ipsec optional!interface Ethernet1/0ip address 209.165.202.147 255.255.255.224crypto map xauthmap!access-list 192 permit ip host 209.165.202.147 host 209.165.202.145crypto ipsec optional retry
To adjust the amount of time that a packet can be routed in the clear (unencrypted), use the crypto ipsec optional retry command in global configuration mode. To return to the default setting (5 minutes), use the no form of this command.
crypto ipsec optional retry seconds
no crypto ipsec optional retry seconds
Syntax Description
seconds
Time a connection can exist before another attempt is made to establish an encrypted IP Security (IPSec) session. The default value is 5 minutes.
Defaults
5 minutes
Command Modes
Global configuration
Command History
Usage Guidelines
You must enable the crypto ipsec optional command, which enables IPSec passive mode, before you can use this command.
Examples
The following example shows how to enable IPSec passive mode:
crypto map xauthmap 10 ipsec-isakmpset peer 209.165.202.145set transform-set xauthtransformmatch address 192!crypto ipsec optionalcrypto ipsec optional retry 60!interface Ethernet1/0ip address 209.165.202.147 255.255.255.224crypto map xauthmap!access-list 192 permit ip host 209.165.202.147 host 209.165.202.145Related Commands
crypto ipsec profile
To define the IPSecurity (IPSec) parameters that are to be used for IPSec encryption between two IPSec routers, use the crypto ipsec profile command in global configuration mode. To delete an IPSec profile, use the no form of this command.
crypto ipsec profile name
no crypto ipsec profile name
Syntax Description
Defaults
An IPSec profile is not defined.
Command Modes
Global configuration
Command History
12.2(13)T
This command was introduced.
12.2(18)SXE
This command was integrated into Cisco IOS Release 12.2(18)SXE.
Usage Guidelines
An IPSec profile abstracts the IPSec policy settings into a single profile that can be used in other parts of the Cisco IOS configuration.
The IPSec profile shares most of the same commands with the crypto map configuration, but only a subset of the commands are valid in an IPSec profile. Only commands that pertain to an IPSec policy can be issued under an IPSec profile; you cannot specify the IPSec peer address or the access control list (ACL) to match the packets that are to be encrypted.
The following valid commands can be configured under an IPSec profile:
•
•
•
•
After enabling this command, the only parameter that must be defined under the profile is the transform set via the set transform-set command.
For more information on transform sets, refer to the section "Defining Transform Sets" in the chapter "Configuring IPSec Network Security" in the Cisco IOS Security Configuration Guide.
Examples
The following example shows how to configure a crypto map that uses an IPSec profile:
crypto ipsec transform-set cat-transforms esp-des esp-sha-hmacmode transport!crypto ipsec profile cat-profileset transform-set cat-transformsset pfs group2!interface Tunnel1ip address 192.168.1.1 255.255.255.252tunnel source FastEthernet2/0tunnel destination 10.13.7.67tunnel protection ipsec profile cat-profileRelated Commands
crypto ipsec security-association idle-time
To configure the IP Security (IPSec) security association (SA) idle timer, use the crypto ipsec security-association idle-time command in global configuration mode or crypto map configuration mode. To inactivate the IPSec SA idle timer, use the no form of this command.
crypto ipsec security-association idle-time seconds
no crypto ipsec security-association idle-time
Syntax Description
seconds
Time, in seconds, that the idle timer will allow an inactive peer to maintain an SA. Valid values for the seconds argument range from 60 to 86400.
Defaults
IPSec SA idle timers are disabled.
Command Modes
Global configuration
Crypto map configurationCommand History
Usage Guidelines
Use the crypto ipsec security-association idle-time command to configure the IPSec SA idle timer. This timer controls the amount of time that an SA will be maintained for an idle peer.
Use the crypto ipsec security-association lifetime command to configure global lifetimes for IPSec SAs. There are two lifetimes: a "timed" lifetime and a "traffic-volume" lifetime. A security association expires after the first of these lifetimes is reached.
The IPSec SA idle timers are different from the global lifetimes for IPSec SAs. The expiration of the global lifetimes is independent of peer activity. The IPSec SA idle timer allows SAs associated with inactive peers to be deleted before the global lifetime has expired.
If the IPSec SA idle timers are not configured with the crypto ipsec security-association idle-time command, only the global lifetimes for IPSec SAs are applied. SAs are maintained until the global timers expire, regardless of peer activity.
Note
Examples
The following example configures the IPSec SA idle timer to drop SAs for inactive peers after 600 seconds:
crypto ipsec security-association idle-time 600Related Commands
clear crypto sa
Deletes IPSec SAs.
crypto ipsec security-association lifetime
Changes global lifetime values used when negotiating IPSec SAs.
crypto ipsec security-association lifetime
To change global lifetime values used when negotiating IPSec security associations, use the crypto ipsec security-association lifetime command in global configuration mode. To reset a lifetime to the default value, use the no form of this command.
crypto ipsec security-association lifetime {seconds seconds | kilobytes kilobytes}
no crypto ipsec security-association lifetime {seconds | kilobytes}
Syntax Description
Defaults
3600 seconds (one hour) and 4,608,000 kilobytes (10 megabits per second for one hour).
Command Modes
Global configuration
Command History
Usage Guidelines
IPSec security associations use shared secret keys. These keys and their security associations time out together.
Assuming that the particular crypto map entry does not have lifetime values configured, when the router requests new security associations during security association negotiation, it will specify its global lifetime value in the request to the peer; it will use this value as the lifetime of the new security associations. When the router receives a negotiation request from the peer, it will use the smaller of the lifetime value proposed by the peer or the locally configured lifetime value as the lifetime of the new security associations.
There are two lifetimes: a "timed" lifetime and a "traffic-volume" lifetime. The security association expires after the first of these lifetimes is reached.
If you change a global lifetime, the change is only applied when the crypto map entry does not have a lifetime value specified. The change will not be applied to existing security associations, but will be used in subsequent negotiations to establish new security associations. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear crypto sa command. Refer to the clear crypto sa command for more details.
To change the global timed lifetime, use the crypto ipsec security-association lifetime seconds form of the command. The timed lifetime causes the security association to time out after the specified number of seconds have passed.
To change the global traffic-volume lifetime, use the crypto ipsec security-association lifetime kilobytes form of the command. The traffic-volume lifetime causes the security association to time out after the specified amount of traffic (in kilobytes) has been protected by the security associations' key.
Shorter lifetimes can make it harder to mount a successful key recovery attack, since the attacker has less data encrypted under the same key to work with. However, shorter lifetimes require more CPU processing time for establishing new security associations.
The lifetime values are ignored for manually established security associations (security associations installed using an ipsec-manual crypto map entry).
How These Lifetimes Work
The security association (and corresponding keys) will expire according to whichever occurs sooner, either after the number of seconds has passed (specified by the seconds keyword) or after the amount of traffic in kilobytes has passed (specified by the kilobytes keyword).
A new security association is negotiated before the lifetime threshold of the existing security association is reached, to ensure that a new security association is ready for use when the old one expires. The new security association is negotiated either 30 seconds before the seconds lifetime expires or when the volume of traffic through the tunnel reaches 256 kilobytes less than the kilobytes lifetime (whichever occurs first).
If no traffic has passed through the tunnel during the entire life of the security association, a new security association is not negotiated when the lifetime expires. Instead, a new security association will be negotiated only when IPSec sees another packet that should be protected.
Examples
The following example shortens both lifetimes, because the administrator feels there is a higher risk that the keys could be compromised. The timed lifetime is shortened to 2700 seconds (45 minutes), and the traffic-volume lifetime is shortened to 2,304,000 kilobytes (10 megabits per second for one half hour).
crypto ipsec security-association lifetime seconds 2700crypto ipsec security-association lifetime kilobytes 2304000Related Commands
crypto ipsec security-association replay disable
To disable anti-replay checking globally, use the crypto ipsec security-association replay disable command in global configuration mode. To reset the configuration to enable anti-replay checking, use the no form of this command.
crypto ipsec security-association replay disable
no crypto ipsec security-association replay disable
Syntax Description
This command has no arguments or keywords.
Defaults
Anti-replay checking is enabled.
Command Modes
Global configuration
Command History
Examples
The following example shows that anti-replay checking has been disabled globally:
crypto map mymap 10exitcrypto ipsec security-association replay disableRelated Commands
crypto ipsec security-association replay window-size
Sets the size of the SA anti-replay window.
crypto ipsec security-association replay window-size
To set the size of the security association (SA) anti-replay window globally, use the crypto ipsec security-association replay window-size command in global configuration mode. To reset the window size to the default of 64, use the no form of this command.
crypto ipsec security-association replay window-size [N]
no crypto ipsec security-association replay window-size
Syntax Description
N
(Optional) Size of the window. Values can be 64, 128, 256, 512, or 1024. This value becomes the default value.
Note
Defaults
If a window size is not entered, the default is 64.
Command Modes
Global configuration
Command History
Examples
The following example shows that the size of the SA anti-replay window has been set globally to 128:
crypto map mymap 20exitcrypto ipsec security-association replay window-size 128Related Commands
crypto ipsec transform-set
To define a transform set—an acceptable combination of security protocols and algorithms—use the crypto ipsec transform-set command in global configuration mode. To delete a transform set, use the no form of this command.
crypto ipsec transform-set transform-set-name transform1 [transform2] [transform3] [transform4]
no crypto ipsec transform-set transform-set-name
Syntax Description
transform-set-name
Name of the transform set to create (or modify).
transform1
transform2
transform3
transform4Type of transform set. You may specify up to four "transforms": one Authentication Header (AH), one Encapsulating Security Payload (ESP) encryption, one ESP authentication, and one compression. These transforms define the IP Security (IPSec) security protocols and algorithms. Accepted transform values are described in Table 17.
Defaults
No default behavior or values
Command Modes
Global configuration
This command invokes the crypto transform configuration mode.
Command History
Usage Guidelines
A transform set is an acceptable combination of security protocols, algorithms, and other settings to apply to IPSec-protected traffic. During the IPSec security association (SA) negotiation, the peers agree to use a particular transform set when protecting a particular data flow.
You can configure multiple transform sets, and then specify one or more of these transform sets in a crypto map entry. The transform set defined in the crypto map entry is used in the IPSec SA negotiation to protect the data flows specified by the access list of that crypto map entry. During the negotiation, the peers search for a transform set that is the same at both peers. When such a transform set is found, it is selected and will be applied to the protected traffic as part of the IPSec SAs of both peers.
When Internet Key Exchange (IKE) is not used to establish SAs, a single transform set must be used. The transform set is not negotiated.
Before a transform set can be included in a crypto map entry, it must be defined using this command.
A transform set specifies one or two IPSec security protocols (either AH, ESP, or both) and specifies which algorithms to use with the selected security protocol. The AH and ESP IPSec security protocols are described in the section "IPSec Protocols: AH and ESP."
To define a transform set, you specify one to four "transforms"—each transform represents an IPSec security protocol (AH or ESP) plus the algorithm you want to use. When the particular transform set is used during negotiations for IPSec SAs, the entire transform set (the combination of protocols, algorithms, and other settings) must match a transform set at the remote peer.
In a transform set you can specify the AH protocol, the ESP protocol, or both. If you specify an ESP protocol in a transform set, you can specify just an ESP encryption transform set or both an ESP encryption transform set and an ESP authentication transform set.
Table 17 lists the acceptable transform set combination selections for the AH and ESP protocols.
Examples of acceptable transform set combinations are as follows:
•
•
•
•
•
•
The parser will prevent you from entering invalid combinations; for example, after you specify an AH transform set, it will not allow you to specify another AH transform set for the current transform set.
IPSec Protocols: AH and ESP
Both the AH and ESP protocols implement security services for IPSec.
AH provides data authentication and antireplay services.
ESP provides packet encryption and optional data authentication and antireplay services.
ESP encapsulates the protected data—either a full IP datagram (or only the payload)—with an ESP header and an ESP trailer. AH is embedded in the protected data; it inserts an AH header immediately after the outer IP header and before the inner IP datagram or payload. Traffic that originates and terminates at the IPSec peers can be sent in either tunnel or transport mode; all other traffic is sent in tunnel mode. Tunnel mode encapsulates and protects a full IP datagram, while transport mode encapsulates or protects the payload of an IP datagram. For more information about modes, see the mode (IPSec) command description.
The esp-seal Transform
There are three limitations on the use of the esp-seal transform set:
•
•
•
Selecting Appropriate Transform Sets
The following tips may help you select transform sets that are appropriate for your situation:
•
•
•
•
•
Note
•
Suggested transform set combinations follow:
•
•
The Crypto Transform Configuration Mode
After you issue the crypto ipsec transform-set command, you are put into the crypto transform configuration mode. While in this mode, you can change the mode to tunnel or transport. (These are optional changes.) After you have made these changes, type exit to return to global configuration mode. For more information about these optional changes, see the match address (IPSec) and mode (IPSec) command descriptions.
Changing Existing Transform Sets
If one or more transform sets are specified in the crypto ipsec transform-set command for an existing transform set, the specified transform sets will replace the existing transform sets for that transform set.
If you change a transform set definition, the change is only applied to crypto map entries that reference the transform set. The change will not be applied to existing SAs but will be used in subsequent negotiations to establish new SAs. If you want the new settings to take effect sooner, you can clear all or part of the SA database by using the clear crypto sa command.
Examples
The following example defines two transform sets. The first transform set will be used with an IPSec peer that supports the newer ESP and AH protocols. The second transform set will be used with an IPSec peer that supports only the older transforms.
Router (config)# crypto ipsec transform-set newer esp-3des esp-sha-hmacRouter (config)# crypto ipsec transform-set older ah-rfc-1828 esp-rfc1829The following example is a sample warning message that is displayed when a user enters an IPSec transform set that the hardware does not support:
Router (config)# crypto ipsec transform transform-1 esp-aes 256 esp-md5WARNING:encryption hardware does not support transformesp-aes 256 within IPSec transform transform-1The following output example shows that SEAL encryption has been correctly configured with an authentication transform set:
Router (config)# crypto ipsec transform-set seal esp-seal esp-sha-hmacThe following example is a warning message that is displayed when SEAL encryption has been configured with a crypto accelerator present:
Router (config)# show running-configcrypto ipsec transform-set seal esp-seal esp-sha-hmac! Disabled because transform not supported by encryption hardwareThe following example is an error message that is displayed when SEAL encryption has been configured without an authentication transform set:
Router (config)# crypto ipsec transform seal esp-sealERROR: Transform requires either ESP or AH authentication.The following example is an error message that is displayed when SEAL encryption has been configured within a manually keyed crypto map:
Router (config)# crypto map green 10 ipsec-manual%Note: This new crypto map will remain disabled until a peer and a valid access list have been configured.Router (config-crypto-map)# set transform sealERROR: transform seal illegal for a manual crypto map.Related Commands
crypto isakmp aggressive-mode disable
To block all Internet Security Association and Key Management Protocol (ISAKMP) aggressive mode requests to and from a device, use the crypto isakmp aggressive-mode disable command in global configuration mode. To disable the blocking, use the no form of this command.
crypto isakmp aggressive-mode disable
no crypto isakmp aggressive-mode disable
Syntax Description
This command has no arguments or keywords.
Defaults
If this command is not configured, Cisco IOS software will attempt to process all incoming ISAKMP aggressive mode security association (SA) connections. In addition, if the device has been configured with the crypto isakmp peer address and the set aggressive-mode password or set aggressive-mode client-endpoint commands, the device will initiate aggressive mode if this command is not configured.
Command Modes
Global configuration
Command History
12.3(1)
This command was introduced on all Cisco IOS platforms that support IP Security (IPSec).
Usage Guidelines
If you configure this command, all aggressive mode requests to the device and all aggressive mode requests made by the device are blocked, regardless of the ISAKMP authentication type (preshared keys or Rivest, Shamir, and Adelman [RSA] signatures).
If a request is made by or to the device for aggressive mode, the following syslog notification is sent:
Unable to initiate or respond to Aggressive Mode while disabled
Note
Examples
The following example shows that all aggressive mode requests to and from a device are blocked:
Router (config)# crypto isakmp aggressive-mode disablecrypto isakmp client configuration address-pool local
To configure the IP address local pool to reference Internet Key Exchange (IKE) on your router, use the crypto isakmp client configuration address-pool local command in global configuration mode. To restore the default value, use the no form of this command.
crypto isakmp client configuration address-pool local pool-name
no crypto isakmp client configuration address-pool local
Syntax Description
Defaults
IP address local pools do not reference IKE.
Command Modes
Global configuration
Command History
12.0(4)XE
This command was introduced.
12.0(7)T
This command was integrated into Cisco IOS release 12.0(7)T.
Examples
The following example references IP address local pools to IKE on your router, with "ire" as the pool-name:
crypto isakmp client configuration address-pool local ireRelated Commands
ip local pool
Configures a local pool of IP addresses to be used when a remote peer connects to a point-to-point interface.
crypto isakmp client configuration group
To specify to which group a policy profile will be defined, use the crypto isakmp client configuration group command in global configuration mode. To remove this command and all associated subcommands from your configuration, use the no form of this command.
crypto isakmp client configuration group {group-name | default}
no crypto isakmp client configuration group
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
Use the crypto isakmp client configuration group command to specify group policy information that needs to be defined or changed. You may wish to change the group policy on your router if you decide to connect to the client using a group ID that does not match the group-name argument.
After enabling this command, which puts you in Internet Security Association Key Management Protocol (ISAKMP) group configuration mode, you can specify characteristics for the group policy using the following commands:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Output for the crypto isakmp client configuration group command (using the key subcommand) will show that the preshared key is either encrypted or unencrypted. An output example for an unencrypted preshared key would be as follows:
crypto isakmp client configuration group key testAn output example for a type 6 encrypted preshared key would be as follows:
crypto isakmp client configuration group
key 6 JK_JHZPeJV_XFZTKCQFYAABSession Monitoring and Limiting for Easy VPN Clients
It is possible to mimic the functionality provided by some RADIUS servers for limiting the number of connections to a specific server group and also for limiting the number of simultaneous logins for users in that group.
To limit the number of connections to a specific server group, use the max-users subcommand. To limit the number of simultaneous logins for users in the server group, use the max-logins subcommand.
The following example shows the RADIUS attribute-value (AV) pairs for the maximum users and maximum logins parameters:
ipsec:max-users=1000ipsec:max-logins=1The max-users and max-logins commands can be enabled together or individually to control the usage of resources by any groups or individuals.
If you use a RADIUS server, such as a CiscoSecure access control server (ACS), it is recommended that you enable this session control on the RADIUS server if the functionality is provided. In this way, usage can be controlled across a number of servers by one central repository. When enabling this feature on the router itself, only connections to groups on that specific device are monitored, and load-sharing scenarios are not accurately accounted for.
Examples
The following example shows how to define group policy information for Mode Configuration push. In this example, the first group name is "cisco" and the second group name is "default." Thus, the default policy will be enforced for all users who do not offer a group name that matches "cisco."
crypto isakmp client configuration group ciscokey ciscodns 2.2.2.2 2.2.2.3wins 6.6.6.6domain cisco.compool fredacl 199!crypto isakmp client configuration group defaultkey ciscodns 2.2.2.2 2.3.2.3pool fredacl 199Related Commands
crypto isakmp enable
To globally enable Internet Key Exchange (IKE) for your peer router, use the crypto isakmp enable command in global configuration mode. To disable IKE for the peer, use the no form of this command.
crypto isakmp enable
no crypto isakmp enable
Syntax Description
This command has no arguments or keywords.
Defaults
IKE is enabled.
Command Modes
Global configuration
Command History
Usage Guidelines
IKE is enabled by default. IKE does not have to be enabled for individual interfaces, but is enabled globally for all interfaces at the router.
If you do not want IKE to be used for your IPSec implementation, you can disable IKE for all your IP Security peers. If you disable IKE for one peer, you must disable it for all IPSec peers.
If you disable IKE, you will have to make these concessions at the peers:
•
•
•
•
•
Note
Examples
The following example disables IKE at one peer. (The same command should be issued for all remote peers.)
no crypto isakmp enablecrypto isakmp identity
To define the identity used by the router when participating in the Internet Key Exchange (IKE) protocol, use the crypto isakmp identity command in global configuration mode. Set an Internet Security Association Key Management Protocol (ISAKMP) identity whenever you specify preshared keys. To reset the ISAKMP identity to the default value (address), use the no form of this command.
crypto isakmp identity {address | hostname}
no crypto isakmp identity
Syntax Description
Defaults
The IP address is used for the ISAKMP identity.
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to specify an ISAKMP identity either by IP address or by host name.
The address keyword is typically used when there is only one interface (and therefore only one IP address) that will be used by the peer for IKE negotiations, and the IP address is known.
The hostname keyword should be used if there is more than one interface on the peer that might be used for IKE negotiations, or if the interface's IP address is unknown (such as with dynamically assigned IP addresses).
As a general rule, you should set all peers' identities in the same way, either by IP address or by host name.
Examples
The following example uses preshared keys at two peers and sets both their
