Use this procedure when you need to secure traffic between devices using a TLS tunnel, typically in environments requiring encrypted communication for compliance or security reasons.

Procedure

Enter global configuration mode.
Example:
```
Device# configure terminal
```

Configure a crypto TLS tunnel channel.

Example:

Device(config)# crypto tls-tunnel TLS-tunnel-name

Example:

Device(config)# crypto tls-tunnel cloud-primary

Specify the server IPv4 address, IPv6 address, or URL name and the port number.
Example:
```
Device(config-crypto-tls-tunnel)# server ipv4 server-ipv4-address port port-number
```
Example:
```
Device(config-crypto-tls-tunnel)# server ipv4 172.31.255.255 port 4043
```
The server can be specified as an IPv4 address, IPv6 address, or URL. The port number must be in the range 1025-65535.
Specify the overlay interface and interface number.
Example:
```
Device(config-crypto-tls-tunnel)# overlay interface interface-name
```
Example:
```
Device(config-crypto-tls-tunnel)# overlay interface Loopback0
```
An overlay interface is a logical, multiaccess, multicast-capable interface. It encapsulates Layer 2 frames in IP unicast or multicast headers.
Specify the LAN interface type, number, and the priority rank.
Example:
```
Device(config-crypto-tls-tunnel)# local-interface interface-name priority priority-rank
```
Example:
```
Device(config-crypto-tls-tunnel)# local-interface vlan 1 priority 1
```
Currently, the tunnel supports only one WAN interface with priority 1 and does not support the list of WAN interfaces with multiple priorities.

Specify a preshared key and password options.

Example:

Device(config-crypto-tls-tunnel)# psk id identity key psk-key

Example:

Device(config-crypto-tls-tunnel)# psk id test key

Specify the trustpoints for use with the RSA signature authentication method.
Example:
```
Device(config-crypto-tls-tunnel)# pki trustpoint trustpoint-label sign-or-verify
```
Example:
```
Device(config-crypto-tls-tunnel)# pki trustpoint tsp1 sign
```
Use the certificate from the trustpoint for signing or verifying. If the sign or verify keyword is not specified, the trustpoint is used for both signing and verification. Authentication can be done using either pre-shared key (PSK) or PKI (certificate based).
Enable common criteria mode (FIPS mode).
Example:
```
Device(config-crypto-tls-tunnel)# cc-mode
```
Indicates a common criteria mode, which is a Federal Information Processing Standards (FIPS) mode.

Enable the TLS tunnel.

Example:

Device(config-crypto-tls-tunnel)# no shutdown

Return to privileged EXEC mode.
Example:
```
Device(config-crypto-tls-tunnel)# end
```

The TLS tunnel is now configured and enabled, providing secure encrypted communication between devices.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.