Cisco 819 Integrated Services Routers Software Configuration Guide

Step 1

crypto isakmp policy priority

Example:

Creates an IKE policy that is used during IKE negotiation. The priority is a number from 1 to 10000, with 1 being the highest.

Also enters the Internet Security Association Key and Management Protocol (ISAKMP) policy configuration mode.

Step 2

encryption {des | 3des | aes | aes 192 | aes 256}

Example:

Specifies the encryption algorithm used in the IKE policy.

The example specifies 168-bit data encryption standard (DES).

Step 3

hash {md5 | sha}

Example:

Specifies the hash algorithm used in the IKE policy.

The example specifies the Message Digest 5 (MD5) algorithm. The default is Secure Hash standard (SHA-1).

Step 4

authentication {rsa-sig | rsa-encr | pre-share}

Example:

Specifies the authentication method used in the IKE policy.

The example specifies a pre-shared key.

Step 5

group {1 | 2 | 5}

Example:

Specifies the Diffie-Hellman group to be used in an IKE policy.

Step 6

lifetime seconds

Example:

Specifies the lifetime, 60 to 86400 seconds, for an IKE security association (SA).

Step 7

exit

Example:

Exits IKE policy configuration mode and enters global configuration mode.

Step 1

crypto isakmp client configuration group { group-name | default }

Example:

Creates an IKE policy group containing attributes to be downloaded to the remote client.

Also enters the Internet Security Association Key and Management Protocol (ISAKMP) group policy configuration mode.

Step 2

key name

Example:

Specifies the IKE pre-shared key for the group policy.

Step 3

dns primary-server

Example:

Specifies the primary Domain Name System (DNS) server for the group.

Note You may also want to specify Windows Internet Naming Service (WINS) servers for the group by using the wins command.

Step 4

domain name

Example:

Specifies group domain membership.

Step 5

exit

Example:

Exits IKE group policy configuration mode and enters global configuration mode.

Step 6

ip local pool {default | poolname} [low-ip-address [high-ip-address]]

Example:

Specifies a local address pool for the group.

For details about this command and additional parameters that can be set, see Cisco IOS Dial Technologies Command Reference.

Step 1

crypto map map-name isakmp authorization list list-name

Example:

Applies mode configuration to the crypto map and enables key lookup (IKE queries) for the group policy from an authentication, authorization, and accounting (AAA) server.

Step 2

crypto map tag client configuration address [initiate | respond]

Example:

Configures the router to reply to mode configuration requests from remote clients.

Step 1

aaa new-model

Example:

Enables the AAA access control model.

Step 2

aaa authentication login {default | list-name} method1 [method2...]

Example:

Specifies AAA authentication of selected users at login, and specifies the method used.

This example uses a local authentication database. You could also use a RADIUS server for this. For details, see Securing User Services Configuration Guide Library, Cisco IOS Release 12.4T and Cisco IOS Security Command Reference.

Step 3

aaa authorization {network | exec | commands level | reverse-access | configuration} {default | list-name} [method1 [method2...]]

Example:

Specifies AAA authorization of all network-related service requests, including PPP, and specifies the method of authorization.

This example uses a local authorization database. You could also use a RADIUS server for this. For details, see Securing User Services Configuration Guide Library, Cisco IOS Release 12.4T and Cisco IOS Security Command Reference.

Step 4

username name {nopassword | password password | password encryption-type encrypted-password}

Example:

Establishes a username-based authentication system.

This example implements a username of Cisco with an encrypted password of Cisco.

Step 1

crypto ipsec transform-set transform-set-name transform1 [transform2] [transform3] [transform4]

Example:

Defines a transform set—an acceptable combination of IPSec security protocols and algorithms.

See Cisco IOS Security Command Reference for details about the valid transforms and combinations.

Step 2

crypto ipsec security-association lifetime {seconds seconds | kilobytes kilobytes}

Example:

Specifies global lifetime values used when IPSec security associations are negotiated.

See Cisco IOS Security Command Reference for details.

Step 1

crypto dynamic-map dynamic-map-name dynamic-seq-num

Example:

Creates a dynamic crypto map entry and enters crypto map configuration mode.

See Cisco IOS Security Command Reference for more details about this command.

Step 2

set transform-set transform-set-name [transform-set-name2...transform-set-name6]

Example:

Specifies which transform sets can be used with the crypto map entry.

Step 3

reverse-route

Example:

Creates source proxy information for the crypto map entry.

See Cisco IOS Security Command Reference for details.

Step 4

exit

Example:

Returns to global configuration mode.

Step 5

crypto map map-name seq-num [ipsec-isakmp] [dynamic dynamic-map-name] [discover] [profile profile-name]

Example:

Creates a crypto map profile.

Step 1

interface type number

Example:

Enters the interface configuration mode for the interface to which you want the crypto map applied.

Step 2

crypto map map-name

Example:

Applies the crypto map to the interface.

See Cisco IOS Security Command Reference for more details about this command.

Step 3

exit

Example:

Returns to global configuration mode.

Step 1

crypto ipsec client ezvpn name

Example:

Creates a Cisco Easy VPN remote configuration and enters Cisco Easy VPN remote configuration mode.

Step 2

group group-name key group-key

Example:

Specifies the IPSec group and IPSec key value for the VPN connection.

Step 3

peer {ipaddress | hostname}

Example:

Specifies the peer IP address or hostname for the VPN connection.

Note A hostname can be specified only when the router has a DNS server available for hostname resolution.

Step 4

mode {client | network-extension | network extension plus}

Example:

Specifies the VPN mode of operation.

Step 5

exit

Example:

Returns to global configuration mode.

Step 6

interface type number

Example:

Enters the interface configuration mode for the interface to which you want the Cisco Easy VPN remote configuration applied.

Note For routers with an ATM WAN interface, this command would be interface atm 0.

Step 7

crypto ipsec client ezvpn name [ outside | inside ]

Example:

Assigns the Cisco Easy VPN remote configuration to the WAN interface, causing the router to automatically create the NAT or port address translation (PAT) and access list configuration needed for the VPN connection.

Step 8

exit

Example:

Returns to global configuration mode.