Cisco Systems OL-6426-02 Benutzerhandbuch

Perform these steps to specify the IPSec transform set and protocols, beginning in global configuration 
mode:

With manually established security associations, there is no negotiation with the peer, and both sides 
must specify the same transform set. 

A dynamic crypto map policy processes negotiation requests for new security associations from remote 
IPSec peers, even if the router does not know all the crypto map parameters (for example, IP address).

Perform these steps to configure the IPSec crypto method, beginning in global configuration mode:

crypto ipsec transform-set transform-set-name 
transform1 [transform2] [transform3] 
[transform4]

Router(config)# crypto ipsec transform-set 

Router(config)# 

Defines a transform set—an acceptable 
combination of IPSec security protocols and 
algorithms.

See the

for detail about the valid transforms and 
combinations.

crypto ipsec security-association lifetime 
{seconds seconds | kilobytes kilobytes}

Router(config)# crypto ipsec 

Router(config)# 

Specifies global lifetime values used when IPSec 
security associations are negotiated.

See the

for details.

crypto dynamic-map dynamic-map-name 
dynamic-seq-num

Router(config)# crypto dynamic-map dynmap 1

Router(config-crypto-map)# 

Creates a dynamic crypto map entry and enters 
crypto map configuration mode.

See the

for more detail about this command.

set transform-set transform-set-name 
[transform-set-name2...transform-set-name6] 

Router(config-crypto-map)# set 

Router(config-crypto-map)# 

Specifies which transform sets can be used with 
the crypto map entry.