Specify a controller and enter controller configuration mode.

Specify the clock source for a link.

line specifies that the link uses the recovered clock from the link and is the default setting. Generally, this setting is most reliable.

internal specifies that the DS1 link uses the internal clock.

loop-timed specifies that the T1 or E1 interface takes the clock from the Rx (line) and uses it for Tx. This setting decouples the controller clock from the system-wide clock set with the network-clock-select command.

Select frame clock.

Specify the framing type for the T1 or E1 data line.

sf specifies Super Frame as the T1 frame type.

esf specifies Extended Super Frame as the T1 frame type.

Specify the line code format.

ami specifies alternate mark inversion (AMI) as the line-code type. Valid for T1 or E1 controllers; the default for T1 lines.

b8zs specifies B8ZS as the line-code type. Valid for T1 controller only.

hdb3 specifies high-density bipolar 3 (hdb3) as the line-code type. Valid for E1 controller only; the default for E1 lines.

Specify the channel group and time slots to be mapped.

Return to global configuration mode.

Create an IKE policy¹ with a unique priority number and enter Internet Security Association and Key Management Protocol (ISAKMP²) policy configuration mode.

Note You can configure multiple policies on each peer³. At least one of these policies must contain exactly the same encryption, authentication, and other parameters as one of the policies on the remote peer.

Gateway(config)# crypto isakmp policy priority

Specify the authentication method to be used in an IKE policy.

Gateway(config-isakmp)# authentication
{rsa-sig|rsa-encr|pre-share}

Return to global configuration mode.

Gateway(config-isakmp)# exit

Configure the authentication key for each peer that shares a key.

Gateway(config)# crypto isakmp key keystring address peer_address|peer_hostname

2A protocol framework that defines payload formats, the mechanics of implementing a key exchange protocol, and the negotiation of a security association.

3In the context of this document, a peer refers to a Catalyst 4224 or other device that participates in IPSec and IKE.

Specify the lifetime of a security association¹.

As a general rule, the shorter the lifetime (up to a point), the more secure your IKE negotiations will be. However, with longer lifetimes, future IPSec security associations can be set up more quickly.

The default lifetimes are 3600 seconds (one hour) and 4608000 kilobytes (10 megabytes per second for one hour).

Specify a transform set² and enter transform-set configuration mode.

To define a transform set, specify one to three "transforms"—each transform represents an IPSec security protocol (ESP or AH) plus the algorithm you want to use. When the particular transform set is used during negotiations for IPSec security associations, the entire transform set (the combination of protocols, algorithms and other settings) must match a transform set at the remote peer.

Return to global configuration mode.

Gateway(cfg-crypto-trans)# exit

Create a crypto map³ denoted by map-name. Enter crypto map configuration mode, unless you use the dynamic keyword.

seq-num is the number you assign to the crypto map entry.

ipsec-isakmp indicates that IKE will be used to establish the IPSec security associations for protecting the traffic specified by this crypto map entry.

dynamic is an optional argument specifying that this crypto map entry references a preexisting dynamic crypto map. Dynamic crypto maps are policy templates used in processing negotiation requests from a peer IPSec device. If you use this keyword, none of the crypto map configuration commands will be available.

dynamic-map-name specifies the name of the dynamic crypto map set that should be used as the policy template.

Gateway(config)# crypto map map_name seq_num ipsec-isakmp [dynamic dynamic_map_name] [discover]

Specify the same remote IPSec peer that you specified in Step 4 in the previous procedure, "Step 2: Configure the Internet Key Exchange Security Protocol" section.

Gateway(config-crypto map)# set peer hostname|ip_address

For this crypto map entry, specify the same transform set that you specified in Step 2 of this procedure.

Gateway(config-crypto map)# set transform-set transform_set_name

Specify an extended access list for a crypto map entry. This value should match the access-list-number or name argument of the extended access list.

Gateway(config-crypto map)# match address [access_list_id | name]

Return to global configuration mode.

Create an access list.⁴

access_list_number denotes an IP list number from 1 through 99.

permit or deny specifies permit or deny condition for this list.

IP-address is the IP address to which the router compares the address being tested.

wild-mask is the wildcard mask bits for the address in 32-bit, dotted decimal notation.

2A transform set represents a specific combination of security protocols and algorithms. During the IPSec security association negotiation, the peers search for a transform set that is the same on both peers. When such a transform set is found, it is selected and applied to the protected traffic as part of both peers' IPSec security associations.

3With IPSec you define what traffic should be protected between two IPSec peers by configuring access lists and applying these access lists to interfaces by way of crypto map sets. A crypto map set can contain multiple entries, each with a different access list. The crypto map entries are searched in order, and the Catalyst 4224 attempts to match the packet to the access list specified in that entry.

4Packet filtering helps control packet movement through the network. Such control can help limit network traffic and restrict network use by certain users or devices. To permit or deny packets from crossing specified interfaces, Cisco provides access lists. An access list is a sequential collection of permit and deny conditions that apply to IP addresses.

Select the serial interface and enter interface configuration mode.

Specify an IP address followed by the subnet mask for this interface.

Assign a crypto map to this interface.

Return to global configuration mode.

Return to the enable mode.

Display the current operating configuration, including any changes just made.

Display the configuration currently stored in nonvolatile random-access memory (NVRAM).

At the enable prompt, write your changes to NVRAM.

Note The results of the show running-config and show startup-config commands differ if you have made changes to the configuration but have not yet written them to NVRAM.