WORLD GOSSPERS ORGANISATION

How to Set Up Your Own Home VPN Server

</div>
<h2>
<br /></h2>
<img alt="home servers" class="alignnone size-full wp-image-221029" height="300" src="http://cdn3.howtogeek.com/wp-content/uploads/2015/07/650x300xhome-servers.jpg.pagespeed.ic.IezG2yxLOD.jpg" width="650" /><br />

<a href="http://www.howtogeek.com/133680/htg-explains-what-is-a-vpn/">VPNs are very useful</a>, whether you’re traveling the world or just <a href="http://www.howtogeek.com/219384/how-to-avoid-snooping-on-hotel-wi-fi-and-other-public-networks/">using public Wi-Fi</a>
 at a coffee shop in your hometown. But you don’t necessarily have to 
pay for a VPN service — you could host your own VPN server at home.<br />

Your home Internet connection’s <a href="http://www.howtogeek.com/215488/how-to-test-your-internet-connection-speed-or-cellular-data-speed/">upload speed</a>
 will really matter here. If you don’t have much upload bandwidth, you 
may want to just use a paid VPN service. Internet service providers 
usually offer much less upload bandwidth than they do download 
bandwidth.<br />

</div>
<h3>
Why You Might Want to Do This</h3>
<div class="relatedside">
<span class="relatedtext" style="background-color: white; color: #666666; float: right; font-family: bebas_neueregular; font-size: 16px; font-weight: normal; padding-left: 10px; position: relative; top: -7px; z-index: 1;">RELATED ARTICLE</span><div class="relateditemwrap" style="border-bottom: 4px solid #CCC; border-top: 4px solid #CCC; margin-left: 6px; padding-left: 0px; padding: 8px;">
<div class="relateditemimg" style="float: left; margin-left: 2px; width: 128px;">
<a href="http://www.howtogeek.com/133680/htg-explains-what-is-a-vpn/" style="font-style: 90%; font-weight: bold; text-decoration: none;"><img src="http://cdn3.howtogeek.com/thumbcache/120/80/47faa125fb1c6babf2cdb988d3268064/wp-content/uploads/2011/07/xwifisecurityheader.jpg.pagespeed.ic.MT0JIUzG4I.jpg" /></a></div>
<span><a href="http://www.howtogeek.com/133680/htg-explains-what-is-a-vpn/" style="font-style: 90%; font-weight: bold; text-decoration: none;">HTG Explains: What is a VPN? (And Why You Might Want to Use One)</a></span><br /><span style="color: #555555; font-size: 90%;">A VPN, or Virtual Private Network, allows you to create a secure connection to another network over the Internet. VPNs...<a href="http://www.howtogeek.com/133680/htg-explains-what-is-a-vpn/" style="font-style: 90%; text-decoration: none;"> [Read Article]</a></span></div>
</div>
A home VPN gives you an encrypted tunnel to use when on public Wi-Fi,
 and it’d even allow you to access country-specific services outside the
 country — so you could use US Netflix when you’re traveling outside the
 US. It would also give you access to your home network and any file 
shares or other servers from anywhere.<br />

You could also allow other people to connect to your home network, 
making it easy to give them access to servers you’re hosting on your 
home network. This would allow you to play PC games designed for a LAN 
over the Internet, too — although there are easier ways to set up a 
temporary network for PC gaming.<br />

<h3>
Get a Router With VPN Capabilities</h3>
<div class="relatedside">
<span class="relatedtext" style="background-color: white; color: #666666; float: right; font-family: bebas_neueregular; font-size: 16px; font-weight: normal; padding-left: 10px; position: relative; top: -7px; z-index: 1;">RELATED ARTICLE</span><div class="relateditemwrap" style="border-bottom: 4px solid #CCC; border-top: 4px solid #CCC; margin-left: 6px; padding-left: 0px; padding: 8px;">
<div class="relateditemimg" style="float: left; margin-left: 2px; width: 128px;">
<a href="http://www.howtogeek.com/211329/which-is-the-best-vpn-protocol-pptp-vs.-openvpn-vs.-l2tpipsec-vs.-sstp/" style="font-style: 90%; font-weight: bold; text-decoration: none;"><img src="http://cdn3.howtogeek.com/thumbcache/120/80/5849fa7fb78f2f72f5ee10a0783409ea/wp-content/uploads/2015/03/ximg_54f9043453503.jpg.pagespeed.ic.CicTC2ycq6.jpg" /></a></div>
<span><a href="http://www.howtogeek.com/211329/which-is-the-best-vpn-protocol-pptp-vs.-openvpn-vs.-l2tpipsec-vs.-sstp/" style="font-style: 90%; font-weight: bold; text-decoration: none;">Which is the Best VPN Protocol? PPTP vs. OpenVPN vs. L2TP/IPsec vs. SSTP</a></span><br /><span style="color: #555555; font-size: 90%;">Want to use a VPN? If you’re looking for a VPN provider or setting up your own VPN, you’ll need...<a href="http://www.howtogeek.com/211329/which-is-the-best-vpn-protocol-pptp-vs.-openvpn-vs.-l2tpipsec-vs.-sstp/" style="font-style: 90%; text-decoration: none;"> [Read Article]</a></span></div>
</div>
Rather than attempting to do this yourself, you can buy a pre-built 
solution. Higher-end home routers often come with built-in VPN servers —
 just look for a wireless router that advertises VPN server support. You
 can then <a href="http://www.howtogeek.com/168379/10-useful-options-you-can-configure-in-your-routers-web-interface/">use your router’s web interface</a> to activate and configure the VPN server.<br />

Be sure to do some research and pick a router that supports the <a href="http://www.howtogeek.com/211329/which-is-the-best-vpn-protocol-pptp-vs.-openvpn-vs.-l2tpipsec-vs.-sstp/">type of VPN</a> you want to use.<br />

<h3>
Get a Router That Supports DD-WRT or Other Third-Party Firmwares</h3>
<div class="relatedside">
<span class="relatedtext" style="background-color: white; color: #666666; float: right; font-family: bebas_neueregular; font-size: 16px; font-weight: normal; padding-left: 10px; position: relative; top: -7px; z-index: 1;">RELATED ARTICLE</span><div class="relateditemwrap" style="border-bottom: 4px solid #CCC; border-top: 4px solid #CCC; margin-left: 6px; padding-left: 0px; padding: 8px;">
<div class="relateditemimg" style="float: left; margin-left: 2px; width: 128px;">
<a href="http://www.howtogeek.com/189073/how-to-use-a-custom-firmware-on-your-router-and-why-you-might-want-to/" style="font-style: 90%; font-weight: bold; text-decoration: none;"><img src="http://cdn3.howtogeek.com/thumbcache/120/80/f28020a1353e3d1fbbf9281105d4d181/wp-content/uploads/2014/05/xlinksys-wrt54g-first-router-with-custom-firmware.jpg.pagespeed.ic.eP_R4rxYlS.jpg" /></a></div>
<span><a href="http://www.howtogeek.com/189073/how-to-use-a-custom-firmware-on-your-router-and-why-you-might-want-to/" style="font-style: 90%; font-weight: bold; text-decoration: none;">How to Use a Custom Firmware on Your Router and Why You Might Want To</a></span><br /><span style="color: #555555; font-size: 90%;">Routers
 are basically little computers. By default, they run a 
manufacture-provided operating system, or firmware, to route network 
traffic and...<a href="http://www.howtogeek.com/189073/how-to-use-a-custom-firmware-on-your-router-and-why-you-might-want-to/" style="font-style: 90%; text-decoration: none;"> [Read Article]</a></span></div>
</div>
<a href="http://www.howtogeek.com/189073/how-to-use-a-custom-firmware-on-your-router-and-why-you-might-want-to/">Custom router firmwares</a>
 are basically new operating systems you can flash onto your router, 
replacing the router’s standard operating system with something new. 
DD-WRT is a popular one, and OpenWrt will also work well.<br />

If you have a router that supports DD-WRT, OpenWrt, or another 
third-party router firmware, you can flash it with that firmware and get
 more features. DD-WRT and similar router firmwares include built-in VPN
 server support, so you can host a VPN server even on routers that don’t
 come with VPN server software.<br />

Be sure to pick up a supported router — or check your current router to <a href="https://www.dd-wrt.com/site/support/router-database">see if it’s supported by DD-WRT</a>. Flash the third-party firmware and enable the VPN server.<br />

<h3>
Make Your Own Dedicated VPN Server</h3>
You could also just use VPN server software on one of your own 
computers. But you’ll probably want to use a computer or device that’s 
on all the time, not a desktop PC you turn off when you leave home.<br />

If you have a computer that’s on all the time, you could just install
 an OpenVPN server or a similar server and host a VPN server on there. 
VPN servers are available for every operating system, from Windows to 
Mac to Linux. You’ll just need to <a href="http://www.howtogeek.com/66214/how-to-forward-ports-on-your-router/">forward the appropriate ports from your router</a> to the computer running the server software.<br />

<div class="relatedside">
<span class="relatedtext" style="background-color: white; color: #666666; float: right; font-family: bebas_neueregular; font-size: 16px; font-weight: normal; padding-left: 10px; position: relative; top: -7px; z-index: 1;">RELATED ARTICLE</span><div class="relateditemwrap" style="border-bottom: 4px solid #CCC; border-top: 4px solid #CCC; margin-left: 6px; padding-left: 0px; padding: 8px;">
<div class="relateditemimg" style="float: left; margin-left: 2px; width: 128px;">
<a href="http://www.howtogeek.com/135996/how-to-create-a-vpn-server-on-your-windows-computer-without-installing-any-software/" style="font-style: 90%; font-weight: bold; text-decoration: none;"><img src="http://cdn3.howtogeek.com/thumbcache/120/80/065adfdd2ab37b93386c20a283a644cc/wp-content/uploads/2013/01/xcreate-vpn-server-in-windows.png.pagespeed.ic.REcWLByEEm.png" /></a></div>
<span><a href="http://www.howtogeek.com/135996/how-to-create-a-vpn-server-on-your-windows-computer-without-installing-any-software/" style="font-style: 90%; font-weight: bold; text-decoration: none;">How to Create a VPN Server on Your Windows Computer Without Installing Any Software</a></span><br /><span style="color: #555555; font-size: 90%;">Windows has the built-in ability to function as VPN server, although this option is hidden. This trick works on both...<a href="http://www.howtogeek.com/135996/how-to-create-a-vpn-server-on-your-windows-computer-without-installing-any-software/" style="font-style: 90%; text-decoration: none;"> [Read Article]</a></span></div>
</div>
<a href="http://www.howtogeek.com/135996/how-to-create-a-vpn-server-on-your-windows-computer-without-installing-any-software/">Windows offers a built-in way to host VPNs</a>,
 and Apple’s Server app also allows you to set up a VPN server. Be 
careful that you know what you’re doing when setting up a server with 
these — you might just want to use an OpenVPN server for more security.<br />

There’s also the option of rolling your own dedicated VPN device. You could take a <a href="http://www.howtogeek.com/138281/the-htg-guide-to-getting-started-with-raspberry-pi/all/">Raspberry Pi</a>
 and install OpenVPN server software, turning it into a lightweight, 
low-power VPN server. You could also install other server software on it
 and use it as a multi-purpose server.<br />

<h3>
Bonus: Host Your Own VPN Server Elsewhere</h3>
There’s one more do-it-yourself option that’s halfway between hosting
 your own VPN server on your own hardware versus paying a VPN provider 
like TunnelBear to provide you with VPN service and a convenient app.<br />

You could host your own VPN server with a web hosting provider, and 
this may actually be a few bucks cheaper a month than going with a 
dedicated VPN provider. You’ll pay the hosting provider for server 
hosting and install a VPN server on the server they’ve provided to you.<br />

Depending on the hosting provider you’ve chosen, this can be a quick 
point-and-click process where you add the VPN server software and get a 
control panel to manage it, or it may require pulling up a command-line 
to install and configure everything from scratch.<br />

<hr />
When doing this, you’ll probably want to <a href="http://www.howtogeek.com/66438/how-to-easily-access-your-home-network-from-anywhere-with-ddns/">set up dynamic DNS on your router</a>. This will give you an easy address you can access your VPN at, even if your home Internet connection’s IP address changes.<br />

Be sure to configure your VPN server securely. You’ll want strong 
security so no one else can connect to your VPN. Even a strong password 
might not be ideal — an OpenVPN server with a key file you need to 
connect would be strong authentication, for example.<br />

<small>Image Credit: <a href="https://www.flickr.com/photos/orcmid/4627706943">Dennis Hamilton on Flickr</a></small>

How to Set Up Your Own Home VPN Server

VPNs are very useful, whether you’re traveling the world or just using public Wi-Fi at a coffee shop in your hometown. But you don’t necessarily have to pay for a VPN service — you could host your …

15 Nov 2015

how to configure vpn in cisco router

<div class="chapter-title">
Site-to-Site and Extranet VPN Business Scenarios</div>
<div class="masthead">
<img alt="" src="http://www.cisco.com/etc/designs/cdc/fw/i/book_content_masthead.gif" /></div>
</div>
</td>
  </tr>
<tr align="left" valign="top">
      <td width="30%">

<div class="collapsing-list">
             <ul>
<li class="open" id="id-378329671">
                
                <a class="menuLink" href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg.html" title="title">Cisco IOS VPN Configuration Guide</a>
                <ul>
<li id="external_docbase:32217466175294004"><div class="nullWidget">
<wbr></wbr></div>
<a class="menuLink" href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342prf.html" title="Preface">Preface</a></li>
<li id="external_docbase:32217466175302004"><div class="nullWidget">
<wbr></wbr></div>
<a class="menuLink" href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342ios1.html" title="Using Cisco IOS Software">Using Cisco IOS Software</a></li>
<li id="external_docbase:32217466175309004"><div class="nullWidget">
<wbr></wbr></div>
<a class="menuLink" href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342des2.html" title="Network Design Considerations">Network Design Considerations</a></li>
<li id="external_docbase:32217466175316004"><div class="nullWidget">
<wbr></wbr></div>
<a class="menuLink" href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342vpn4.html" title="Remote Access VPN Business Scenarios">Remote Access VPN Business Scenarios</a></li>
<li id="external_docbase:32217466175323004"><div class="nullWidget">
<wbr></wbr></div>
<a class="menuLinkOn" href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html" title="Site-to-Site and Extranet VPN Business Scenarios">Site-to-Site and Extranet VPN Business Scenarios</a></li>
<li id="external_docbase:32217466175335004"><div class="nullWidget">
<wbr></wbr></div>
<a class="menuLink" href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342too5.html" title="VPN Network Management Tools">VPN Network Management Tools</a></li>
<li id="external_docbase:32217466175344004"><div class="nullWidget">
<wbr></wbr></div>
<a class="menuLink" href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342titl.html" title="Title Page ">Title Page </a></li>
<li id="external_docbase:32217466175354004"><div class="nullWidget">
<wbr></wbr></div>
<a class="menuLink" href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342bk.html" title="Index">Index</a></li>
</ul>
</li>
</ul>
</div>
</td>

<table>
    <tbody>
<tr>
            <td>
                  
                                  <span style="color: black; font-weight: normal;">
                                    Downloads: 
                                        <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.pdf">This chapter<img alt="pdf" height="16" src="http://www.cisco.com/etc/designs/cdc/fw/i/books/icon_pdf.gif" width="20" /></a> (PDF - 625.0 KB)

<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg.pdf">The complete book<img alt="PDF" height="16" src="http://www.cisco.com/etc/designs/cdc/fw/i/books/icon_pdf.gif" width="20" /></a> (PDF - 2.05 MB)

<img border="0" id="renditionfeedbacklink_img" src="http://www.cisco.com/etc/designs/cdc/fw/i/sm_0000EE_oo1.gif" target="feedback_window" title="Feedback" />
<a href="https://secure.opinionlab.com/ccc01/o.asp?id=HPXysfff" id="renditionfeedbacklink_link" target="feedback_window">Feedback</a>

</span>
                    
          </td>
        </tr>
</tbody>
</table>
<hr />

<blockquote>
 
    
   <h2 class="p_H_Head1">
Table Of Contents</h2>
<div class="MiniTOC1">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1002608">Site-to-Site and Extranet VPN Business Scenarios</a></div>
<div class="MiniTOC2">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035730">Scenario Descriptions</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035810">Site-to-Site Scenario</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035933">Extranet Scenario</a></div>
<div class="MiniTOC2">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036058">Step 1—Configuring the Tunnel</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036092">Configuring a GRE Tunnel</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036110">Configuring the Tunnel Interface, Source, and Destination</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036178">Verifying the Tunnel Interface, Source, and Destination</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036221">Configuring an IPSec Tunnel</a></div>
<div class="MiniTOC2">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036247">Step 2—Configuring Network Address Translation</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036313">Configuring Static Inside Source Address Translation</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036368">Verifying Static Inside Source Address Translation</a></div>
<div class="MiniTOC2">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036397">Step 3—Configuring Encryption and IPSec</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036454">Configuring IKE Policies</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036481">Creating IKE Policies</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036553">Additional Configuration Required for IKE Policies</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036585">Configuring Pre-shared Keys</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1046307">Configuring the Cisco 7200 Series Router for Digital Certificate Interoperability</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036704">Verifying IKE Policies</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1050178">Configuring a Different Shared Key</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036799">Configuring IPSec and IPSec Tunnel Mode</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036823">Creating Crypto Access Lists</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036847">Verifying Crypto Access Lists</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036857">Defining Transform Sets and Configuring IPSec Tunnel Mode</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036901">Verifying Transform Sets and IPSec Tunnel Mode</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036915">Configuring Crypto Maps</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036953">Creating Crypto Map Entries</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037071">Verifying Crypto Map Entries</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037093">Applying Crypto Maps to Interfaces</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037138">Verifying Crypto Map Interface Associations</a></div>
<div class="MiniTOC2">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037153">Step 4—Configuring Quality of Service</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037207">Configuring Network-Based Application Recognition</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037238">Configuring a Class Map</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037282">Verifying a Class Map Configuration</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037289">Configuring a Policy Map</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037364">Attaching a Policy Map to an Interface</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037393">Verifying a Policy Map Configuration</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1043858">Configuring Weighted Fair Queuing</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037473">Verifying Weighted Fair Queuing</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037499">Configuring Class-Based Weighted Fair Queuing</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037523">Defining a Class Map</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037564">Configuring Class Policy in the Policy Map (Tail Drop)</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037626">Attaching the Service Policy and Enabling CBWFQ</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037642">Verifying Class-Based Weighted Fair Queuing</a></div>
<div class="MiniTOC2">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037666">Step 5—Configuring Cisco IOS Firewall Features</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037732">Creating Extended Access Lists Using Access List Numbers</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037763">Verifying Extended Access Lists</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037775">Applying Access Lists to Interfaces</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037821">Verifying Extended Access Lists Are Applied Correctly</a></div>
<div class="MiniTOC2">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037842">Comprehensive Configuration Examples</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037844">Site-to-Site Scenario</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037857">Headquarters Router Configuration</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037938">Remote Office Router Configuration</a></div>
<div class="MiniTOC3">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1038013">Extranet Scenario</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1038027">Headquarters Router Configuration</a></div>
<div class="MiniTOC4">
<a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1038141">Business Partner Router Configuration</a></div>
<br /> 
    
   <a href="https://www.blogger.com/null" name="wp997838"></a> 
   <a href="https://www.blogger.com/null" name="wpxref58671"></a> 
   <a href="https://www.blogger.com/null" name="wp1002608"></a> 
   <a href="https://www.blogger.com/null" name="wpxref35560"></a> 
   <h2 class="pCT_ChapTitle">
 Site-to-Site and Extranet VPN Business Scenarios </h2>
<hr class="Chap1" />
 
   <a href="https://www.blogger.com/null" name="wp1046233"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1046232"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1046234"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1046235"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1046236"></a> 
   <div class="pB1_Body1">
 This chapter explains the basic tasks for 
configuring IP-based, site-to-site and extranet Virtual Private Networks
 (VPNs) on a Cisco 7200 series router using generic routing 
encapsulation (GRE) and IPSec tunneling protocols. Basic security, 
Network Address Translation (NAT), Encryption, Cisco IOS weighted fair 
queuing (WFQ), and extended access lists for basic traffic filtering are
 configured. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1046255"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />In
 this Guide, the term `Cisco 7200 series router' implies that an 
Integrated Service Adaptor (ISA) or a VAM (VAM, VAM2, or VAM2+) is 
installed in the Cisco 7200 series router. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1035688"></a> 
   <div class="pB1_Body1">
 This chapter describes basic features and 
configurations used in a site-to-site VPN scenario. Some Cisco IOS 
security software features not described in this document can be used to
 increase performance and scalability of your VPN. For up-to-date 
Cisco IOS security software features documentation, refer to the <span style="color: black; font-style: italic; font-weight: normal;">Cisco IOS Security Configuration Guide</span> and the <span style="color: black; font-style: italic; font-weight: normal;">Cisco IOS Security Command Reference</span> publications for your Cisco IOS Release. For information on how to access the publications, see <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342prf.html#wpxref74569"><span class="cXRef_Color" style="font-weight: normal;">"Related Documentation" section on page xi</span></a>. </div>
<a href="https://www.blogger.com/null" name="wp1035699"></a> 
   <div class="pB1_Body1">
 This chapter includes the following sections: </div>
<a href="https://www.blogger.com/null" name="wp1035703"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035730">Scenario Descriptions</a> </div>
<a href="https://www.blogger.com/null" name="wp1035707"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036058">Step 1—Configuring the Tunnel</a> </div>
<a href="https://www.blogger.com/null" name="wp1035711"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036247">Step 2—Configuring Network Address Translation</a> </div>
<a href="https://www.blogger.com/null" name="wp1035715"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036397">Step 3—Configuring Encryption and IPSec</a> </div>
<a href="https://www.blogger.com/null" name="wp1035719"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037153">Step 4—Configuring Quality of Service</a> </div>
<a href="https://www.blogger.com/null" name="wp1035723"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037666">Step 5—Configuring Cisco IOS Firewall Features</a> </div>
<a href="https://www.blogger.com/null" name="wp1035727"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037842">Comprehensive Configuration Examples</a> </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1035728"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />Throughout
 this chapter, there are numerous configuration examples and sample 
configuration outputs that include unusable IP addresses. Be sure to use
 your own IP addresses when configuring your Cisco 7200 series router. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Scenario_Descriptions"> </a> 
   <a href="https://www.blogger.com/null" name="wp1035730"></a> 
   <a href="https://www.blogger.com/null" name="wpxref25836"></a> 
   <h2 class="p_H_Head1">
 Scenario Descriptions </h2>
<a href="https://www.blogger.com/null" name="wp1035731"></a> 
   <div class="pB1_Body1">
 This section includes the following topics: </div>
<a href="https://www.blogger.com/null" name="wp1035735"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035810">Site-to-Site Scenario</a> </div>
<a href="https://www.blogger.com/null" name="wp1035739"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035933">Extranet Scenario</a> </div>
<a href="https://www.blogger.com/null" name="wp1035743"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036092">Configuring a GRE Tunnel</a> </div>
<a href="https://www.blogger.com/null" name="wp1035747"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036221">Configuring an IPSec Tunnel</a> </div>
<a href="https://www.blogger.com/null" name="wp1035751"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036313">Configuring Static Inside Source Address Translation</a> </div>
<a href="https://www.blogger.com/null" name="wp1035755"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036368">Verifying Static Inside Source Address Translation</a> </div>
<a href="https://www.blogger.com/null" name="wp1035759"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036454">Configuring IKE Policies</a> </div>
<a href="https://www.blogger.com/null" name="wp1035763"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036704">Verifying IKE Policies</a> </div>
<a href="https://www.blogger.com/null" name="wp1035767"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036799">Configuring IPSec and IPSec Tunnel Mode</a> </div>
<a href="https://www.blogger.com/null" name="wp1035771"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036915">Configuring Crypto Maps</a> </div>
<a href="https://www.blogger.com/null" name="wp1035775"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037207">Configuring Network-Based Application Recognition</a> </div>
<a href="https://www.blogger.com/null" name="wp1035779"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1043858">Configuring Weighted Fair Queuing</a> </div>
<a href="https://www.blogger.com/null" name="wp1035783"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037473">Verifying Weighted Fair Queuing</a> </div>
<a href="https://www.blogger.com/null" name="wp1035787"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037499">Configuring Class-Based Weighted Fair Queuing</a> </div>
<a href="https://www.blogger.com/null" name="wp1035791"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037642">Verifying Class-Based Weighted Fair Queuing</a> </div>
<a href="https://www.blogger.com/null" name="wp1035795"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037732">Creating Extended Access Lists Using Access List Numbers</a> </div>
<a href="https://www.blogger.com/null" name="wp1035799"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037763">Verifying Extended Access Lists</a> </div>
<a href="https://www.blogger.com/null" name="wp1035803"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037775">Applying Access Lists to Interfaces</a> </div>
<a href="https://www.blogger.com/null" name="wp1035807"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037821">Verifying Extended Access Lists Are Applied Correctly</a> </div>
<a href="https://www.blogger.com/null" name="Site-to-Site_Scenario"> </a> 
   <a href="https://www.blogger.com/null" name="wp1035810"></a> 
   <a href="https://www.blogger.com/null" name="wpxref14554"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1035809"></a> 
   <h3 class="p_H_Head2">
 Site-to-Site Scenario </h3>
<a href="https://www.blogger.com/null" name="wp1035815"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1035814"></a> 
   <div class="pB1_Body1">
 <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035819">Figure 3-1</a>
 shows a headquarters network providing a remote office access to the 
corporate intranet. In this scenario, the headquarters and remote office
 are connected through a secure GRE tunnel that is established over an 
IP infrastructure (the Internet). Employees in the remote office are 
able to access internal, private web pages and perform various IP-based 
network tasks. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1035816"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />Although
 the site-to-site VPN scenario in this chapter is configured with GRE 
tunneling, a site-to-site VPN can also be configured with IPSec only 
tunneling. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1035819"></a> 
   <a href="https://www.blogger.com/null" name="wpxref29054"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1035818"></a> 
   <div class="pTC_TableCap">
 Figure 3-1 Site-to-Site VPN Business Scenario </div>
<a href="https://www.blogger.com/null" name="wp1035823"></a> 
   <div class="pGraphicAnchor">
 </div>
<div align="left">
 
    <img border="0" hspace="0" id="wp1035821" src="http://www.cisco.com/c/dam/en/us/td/i/000001-100000/20001-25000/23001-23500/23244.ps/_jcr_content/renditions/23244.jpg" vspace="0" /> 
   </div>
<div class="pGraphicAnchor">
 </div>
<a href="https://www.blogger.com/null" name="wp1047678"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1047677"></a> 
   <div class="pB1_Body1">
 <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1045708">Figure 3-2</a>
 shows the physical elements of the scenario. The Internet provides the 
core interconnecting fabric between the headquarters and remote office 
routers. Both the headquarters and remote office are using a Cisco IOS 
VPN gateway (a Cisco 7200 series with an Integrated Service Adaptor 
(ISA) or VAM (VAM, VAM2, or VAM2+), a Cisco 2600 series router, or a 
Cisco 3600 series router). </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1047682"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />VPN Acceleration Module (VAM) information for your Cisco 7200 series router can be found at <span class="cXRef_Color" style="font-weight: normal;">http://www.cisco.com/en/US/products/hw/routers/ps341/products_installation_and_configuration_guides_list.html</span>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1035837"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1035836"></a> 
   <div class="pB1_Body1">
 The GRE tunnel is configured on the first 
serial interface in chassis slot 1 (serial 1/0) of the headquarters and 
remote office routers. Fast Ethernet interface 0/0 of the headquarters 
router is connected to a corporate server and Fast Ethernet interface 
0/1 is connected to a web server. Fast Ethernet interface 0/0 of the 
remote office router is connected to a PC client. </div>
<a href="https://www.blogger.com/null" name="wp1045708"></a> 
   <a href="https://www.blogger.com/null" name="wpxref35719"></a> 
   <div class="pTC_TableCap">
 Figure 3-2 Site-to-Site VPN Scenario Physical Elements </div>
<a href="https://www.blogger.com/null" name="wp1045718"></a> 
   <div class="pGraphicAnchor">
 </div>
<div align="left">
 
    <img border="0" hspace="0" id="wp1045719" src="http://www.cisco.com/c/dam/en/us/td/i/000001-100000/20001-25000/23001-23500/23245.ps/_jcr_content/renditions/23245.jpg" vspace="0" /> 
   </div>
<div class="pGraphicAnchor">
 </div>
<a href="https://www.blogger.com/null" name="wp1035845"></a> 
   <div class="pB1_Body1">
 The configuration steps in the following 
sections are for the headquarters router, unless noted otherwise. 
Comprehensive configuration examples for both the headquarters and 
remote office routers are provided in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037842">"Comprehensive Configuration Examples" section</a>. </div>
<a href="https://www.blogger.com/null" name="wp1035852"></a> 
   <div class="pB1_Body1">
 <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035857">Table 3-1</a> lists the physical elements of the site-to-site scenario. </div>
<a href="https://www.blogger.com/null" name="wp1035931"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" id="wp1035857table1035853" style="width: 80%px;"> 
     <caption> 
      <a href="https://www.blogger.com/null" name="wp1035857"></a> 
      <a href="https://www.blogger.com/null" name="wpxref75933"></a> 
      <a href="https://www.blogger.com/null" name="wpmkr1035856"></a> 
      <div class="pTC_TableCap">
 Table 3-1 Physical Elements </div>
</caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th colspan="3" rowspan="1" scope="col"><a href="https://www.blogger.com/null" name="wp1035869"></a> 
        <div class="pCH1_CellHead1">
          Headquarters Network 
        </div>
</th> 
       <th colspan="3" rowspan="1" scope="col"><a href="https://www.blogger.com/null" name="wp1035875"></a> 
        <div class="pCH1_CellHead1">
          Remote Office Network 
        </div>
</th> 
      </tr>
<tr align="left" valign="bottom"> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1035881"></a> 
        <div class="pCH1_CellHead1">
          Site Hardware 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1035883"></a> 
        <div class="pCH1_CellHead1">
          WAN IP 
         <br />Address 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1035885"></a> 
        <div class="pCH1_CellHead1">
          Ethernet IP Address 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1035887"></a> 
        <div class="pCH1_CellHead1">
          Site 
         <br /> Hardware 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1035889"></a> 
        <div class="pCH1_CellHead1">
          WAN IP 
         <br />Address 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1035891"></a> 
        <div class="pCH1_CellHead1">
          Ethernet IP Address 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1035893"></a><div class="pB1_Body1">
 hq-sanjose </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1035895"></a><div class="pB1_Body1">
 Serial interface 1/0:<br />172.17.2.4<br />255.255.255.0 </div>
<a href="https://www.blogger.com/null" name="wp1035896"></a><div class="pB1_Body1">
 Tunnel interface 0:<br />172.17.3.3<br />255.255.255.0 </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1035898"></a><div class="pB1_Body1">
 Fast Ethernet <br />Interface 0/0:<br />10.1.3.3<br />255.255.255.0 </div>
<a href="https://www.blogger.com/null" name="wp1035899"></a><div class="pB1_Body1">
 Fast Ethernet <br />Interface 0/1:<br />10.1.6.4<br />255.255.255.0 </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1035901"></a><div class="pB1_Body1">
 ro-rtp </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1035903"></a><div class="pB1_Body1">
 Serial interface 1/0:<br />172.24.2.5<br />255.255.255.0 </div>
<a href="https://www.blogger.com/null" name="wp1035904"></a><div class="pB1_Body1">
 Tunnel interface 1:<br />172.24.3.6<br />255.255.255.0 </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1035906"></a><div class="pB1_Body1">
 Fast Ethernet <br />Interface 0/0:<br />10.1.4.2<br />255.255.255.0 </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1035908"></a><div class="pB1_Body1">
 Corporate server </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1035910"></a><div class="pB1_Body1">
 — </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1035912"></a><div class="pB1_Body1">
 10.1.3.6 </div>
</td> 
       <td colspan="1" rowspan="2"><a href="https://www.blogger.com/null" name="wp1035914"></a><div class="pB1_Body1">
 PC A </div>
</td> 
       <td colspan="1" rowspan="2"><a href="https://www.blogger.com/null" name="wp1035916"></a><div class="pB1_Body1">
 — </div>
</td> 
       <td colspan="1" rowspan="2"><a href="https://www.blogger.com/null" name="wp1035918"></a><div class="pB1_Body1">
 10.1.4.3 </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1035920"></a><div class="pB1_Body1">
 Web server </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1035922"></a><div class="pB1_Body1">
 — </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1035924"></a><div class="pB1_Body1">
 10.1.6.5 </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<br /> 
   <div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Extranet_Scenario"> </a> 
   <a href="https://www.blogger.com/null" name="wp1035933"></a> 
   <a href="https://www.blogger.com/null" name="wpxref15378"></a> 
   <h3 class="p_H_Head2">
 Extranet Scenario </h3>
<a href="https://www.blogger.com/null" name="wp1035937"></a> 
   <div class="pB1_Body1">
 The extranet scenario introduced in <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035940">Figure 3-3</a>
 builds on the site-to-site scenario by providing a business partner 
access to the same headquarters network. In the extranet scenario, the 
headquarters and business partner are connected through a secure IPSec 
tunnel and the business partner is given access only to the headquarters
 public server to perform various IP-based network tasks, such as 
placing and managing product orders. </div>
<a href="https://www.blogger.com/null" name="wp1035940"></a> 
   <a href="https://www.blogger.com/null" name="wpxref84669"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1035939"></a> 
   <div class="pTC_TableCap">
 Figure 3-3 Extranet VPN Business Scenario </div>
<a href="https://www.blogger.com/null" name="wp1035944"></a> 
   <div class="pGraphicAnchor">
 </div>
<div align="left">
 
    <img border="0" hspace="0" id="wp1035942" src="http://www.cisco.com/c/dam/en/us/td/i/000001-100000/20001-25000/24001-24500/24219.ps/_jcr_content/renditions/24219.jpg" vspace="0" /> 
   </div>
<div class="pGraphicAnchor">
 </div>
<a href="https://www.blogger.com/null" name="wp1035949"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1035948"></a> 
   <div class="pB1_Body1">
 <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035960">Figure 3-4</a>
 shows the physical elements of the scenario. As in the site-to-site 
business scenario, the Internet provides the core interconnecting fabric
 between the headquarters and business partner routers. Like the 
headquarters office, the business partner is also using a Cisco IOS VPN 
gateway (a Cisco 7200 series with an Integrated Service Adaptor (ISA) or
 VAM (VAM, VAM2, or VAM2+), a Cisco 2600 series router, or a Cisco 3600 
series router). </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1048293"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />VPN Acceleration Module (VAM) information for your Cisco 7200 series router can be found at <span class="cXRef_Color" style="font-weight: normal;">http://www.cisco.com/en/US/products/hw/routers/ps341/products_installation_and_configuration_guides_list.html</span>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1035957"></a> 
   <div class="pB1_Body1">
 The IPSec tunnel between the two sites is 
configured on the second serial interface in chassis slot 2 (serial 2/0)
 of the headquarters router and the first serial interface in chassis 
slot 1 (serial 1/0) of the business partner router. Fast Ethernet 
interface 0/0 of the headquarters router is still connected to a private
 corporate server and Fast Ethernet interface 0/1 is connected to a 
public server. Fast Ethernet interface 0/0 of the business partner 
router is connected to a PC client. </div>
<a href="https://www.blogger.com/null" name="wp1035960"></a> 
   <a href="https://www.blogger.com/null" name="wpxref46260"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1035959"></a> 
   <div class="pTC_TableCap">
 Figure 3-4 Extranet VPN Scenario Physical Elements </div>
<a href="https://www.blogger.com/null" name="wp1035964"></a> 
   <div class="pGraphicAnchor">
 </div>
<div align="left">
 
    <img border="0" hspace="0" id="wp1035962" src="http://www.cisco.com/c/dam/en/us/td/i/000001-100000/20001-25000/24001-24500/24218.ps/_jcr_content/renditions/24218.jpg" vspace="0" /> 
   </div>
<div class="pGraphicAnchor">
 </div>
<a href="https://www.blogger.com/null" name="wp1035965"></a> 
   <div class="pB1_Body1">
 The configuration steps in the following 
sections are for the headquarters router, unless noted otherwise. 
Comprehensive configuration examples for both the headquarters and 
business partner routers are provided in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037842">"Comprehensive Configuration Examples" section</a>. </div>
<a href="https://www.blogger.com/null" name="wp1035973"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1035972"></a> 
   <div class="pB1_Body1">
 <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035977">Table 3-2</a> lists the extranet scenario's physical elements. </div>
<a href="https://www.blogger.com/null" name="wp1036055"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" id="wp1035977table1035974" style="width: 80%px;"> 
     <caption> 
      <a href="https://www.blogger.com/null" name="wp1035977"></a> 
      <a href="https://www.blogger.com/null" name="wpxref48864"></a> 
      <div class="pTC_TableCap">
 Table 3-2 Physical Elements </div>
</caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th colspan="3" rowspan="1" scope="col"><a href="https://www.blogger.com/null" name="wp1035989"></a> 
        <div class="pCH1_CellHead1">
          Headquarters Network 
        </div>
</th> 
       <th colspan="3" rowspan="1" scope="col"><a href="https://www.blogger.com/null" name="wp1035995"></a> 
        <div class="pCH1_CellHead1">
          Business Partner Network 
        </div>
</th> 
      </tr>
<tr align="left" valign="bottom"> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036001"></a> 
        <div class="pCH1_CellHead1">
          Site Hardware 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036003"></a> 
        <div class="pCH1_CellHead1">
          WAN IP 
         <br />Address 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036005"></a> 
        <div class="pCH1_CellHead1">
          Ethernet IP Address 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036007"></a> 
        <div class="pCH1_CellHead1">
          Site 
         <br /> Hardware 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036009"></a> 
        <div class="pCH1_CellHead1">
          WAN IP 
         <br />Address 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036011"></a> 
        <div class="pCH1_CellHead1">
          Ethernet IP Address 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036013"></a><div class="pB1_Body1">
 hq-sanjose </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036015"></a><div class="pB1_Body1">
 Serial interface 2/0:<br />172.16.2.2<br />255.255.255.0 </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036017"></a><div class="pB1_Body1">
 Fast Ethernet <br />Interface 0/0:<br />10.1.3.3<br />255.255.255.0 </div>
<a href="https://www.blogger.com/null" name="wp1036018"></a><div class="pB1_Body1">
 Fast Ethernet <br />Interface 0/1:<br />10.1.6.4<br />255.255.255.0 </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036020"></a><div class="pB1_Body1">
 bus-ptnr </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036022"></a><div class="pB1_Body1">
 Serial interface 1/0:<br />172.23.2.7<br />255.255.255.0 </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036024"></a><div class="pB1_Body1">
 Fast Ethernet <br />Interface 0/0:<br />10.1.5.2<br />255.255.255.0 </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036026"></a><div class="pB1_Body1">
 Corporate server </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036028"></a><div class="pB1_Body1">
 — </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036030"></a><div class="pB1_Body1">
 10.1.3.6 </div>
</td> 
       <td colspan="1" rowspan="2"><a href="https://www.blogger.com/null" name="wp1036032"></a><div class="pB1_Body1">
 PC B </div>
</td> 
       <td colspan="1" rowspan="2"><a href="https://www.blogger.com/null" name="wp1036034"></a><div class="pB1_Body1">
 — </div>
</td> 
       <td colspan="1" rowspan="2"><a href="https://www.blogger.com/null" name="wp1036036"></a><div class="pB1_Body1">
 10.1.5.3 </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036038"></a><div class="pB1_Body1">
 Web server </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036040"></a><div class="pB1_Body1">
 — </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036048"></a><div class="pB1_Body1">
 10.1.6.5<sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036044">1</a> </sup> </div>
</td> 
      </tr>
</tbody> 
    </table>
<table> 
     <tbody>
<tr> 
       <td><a href="https://www.blogger.com/null" name="wp1036044"></a><div class="pTF_tableFootnote">
 <sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036048">1</a> </sup>The
 inside local IP address of the headquarters network public server 
(10.1.6.5) is translated to inside global IP address 10.2.2.2 in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036247">"Step 2—Configuring Network Address Translation" section</a>. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<br /> 
   <div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Step_1-Configuring_the_Tunnel"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036058"></a> 
   <a href="https://www.blogger.com/null" name="wpxref26098"></a> 
   <a href="https://www.blogger.com/null" name="wpxref32952"></a> 
   <h2 class="p_H_Head1">
 Step 1—Configuring the Tunnel </h2>
<a href="https://www.blogger.com/null" name="wp1036060"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036059"></a> 
   <div class="pB1_Body1">
 Tunneling provides a way to encapsulate packets
 inside of a transport protocol. Tunneling is implemented as a virtual 
interface to provide a simple interface for configuration. The tunnel 
interface is not tied to specific "passenger" or "transport" protocols, 
but rather, it is an architecture that is designed to provide the 
services necessary to implement any standard point-to-point 
encapsulation scheme. Because tunnels are point-to-point links, you must
 configure a separate tunnel for each link. </div>
<a href="https://www.blogger.com/null" name="wp1036062"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036061"></a> 
   <div class="pB1_Body1">
 Tunneling has the following three primary components: </div>
<a href="https://www.blogger.com/null" name="wp1036064"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036063"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Passenger
 protocol, which is the protocol you are encapsulating (AppleTalk, 
Banyan VINES, Connectionless Network Service [CLNS], DECnet, IP, or 
Internetwork Packet Exchange [IPX]). </div>
<a href="https://www.blogger.com/null" name="wp1036067"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036065"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036066"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Carrier protocol, such as the generic routing encapsulation (GRE) protocol or IPSec protocol. </div>
<a href="https://www.blogger.com/null" name="wp1036069"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036068"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Transport protocol, such as IP, which is the protocol used to carry the encapsulated protocol. </div>
<a href="https://www.blogger.com/null" name="wp1039630"></a> 
   <div class="pB1_Body1">
 <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1039633">Figure 3-5</a> illustrates IP tunneling terminology and concepts. </div>
<a href="https://www.blogger.com/null" name="wp1039633"></a> 
   <a href="https://www.blogger.com/null" name="wpxref38338"></a> 
   <div class="pTC_TableCap">
 Figure 3-5 IP Tunneling Terminology and Concepts </div>
<a href="https://www.blogger.com/null" name="wp1039637"></a> 
   <div class="pGraphicAnchor">
 </div>
<div align="left">
 
    <img border="0" hspace="0" id="wp1039635" src="http://www.cisco.com/c/dam/en/us/td/i/000001-100000/20001-25000/24001-24500/24217.ps/_jcr_content/renditions/24217.jpg" vspace="0" /> 
   </div>
<div class="pGraphicAnchor">
 </div>
<a href="https://www.blogger.com/null" name="wp1036081"></a> 
   <a href="https://www.blogger.com/null" name="wp1036082"></a> 
   <div class="pB1_Body1">
 This section contains the following topics: </div>
<a href="https://www.blogger.com/null" name="wp1036086"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036092">Configuring a GRE Tunnel</a> </div>
<a href="https://www.blogger.com/null" name="wp1036090"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036221">Configuring an IPSec Tunnel</a> </div>
<a href="https://www.blogger.com/null" name="Configuring_a_GRE_Tunnel"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036092"></a> 
   <a href="https://www.blogger.com/null" name="wpxref72236"></a> 
   <h3 class="p_H_Head2">
 Configuring a GRE Tunnel </h3>
<a href="https://www.blogger.com/null" name="wp1036093"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036094"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036095"></a> 
   <div class="pB1_Body1">
 GRE is capable of handling the transportation 
of multiprotocol and IP multicast traffic between two sites, which only 
have IP unicast connectivity. The importance of using tunnels in a VPN 
environment is based on the fact that IPSec encryption only works on IP 
unicast frames. Tunneling allows for the encryption and the 
transportation of multiprotocol traffic across the VPN since the 
tunneled packets appear to the IP network as an IP unicast frame between
 the tunnel endpoints. If all connectivity must go through the home 
Cisco 7200 series router , tunnels also enable the use of private 
network addressing across a service provider's backbone without the need
 for running the Network Address Translation (NAT) feature. </div>
<a href="https://www.blogger.com/null" name="wp1036097"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036096"></a> 
   <div class="pB1_Body1">
 Network redundancy (resiliency) is an important
 consideration in the decision to use GRE tunnels, IPSec tunnels, or 
tunnels which utilize IPSec over GRE. GRE can be used in conjunction 
with IPSec to pass routing updates between sites on an IPSec VPN. GRE 
encapsulates the clear text packet, then IPSec (in transport or tunnel 
mode) encrypts the packet.This packet flow of IPSec over GRE enables 
routing updates, which are generally multicast, to be passed over an 
encrypted link. IPSec alone can not achieve this, because it does not 
support multicast. </div>
<a href="https://www.blogger.com/null" name="wp1036098"></a> 
   <div class="pB1_Body1">
 Using redundant GRE tunnels protected by IPSec 
from a remote router to redundant headquarter routers, routing protocols
 can be employed to delineate the "primary" and "secondary" headquarter 
routers. Upon loss of connectivity to the primary router, routing 
protocols will discover the failure and route to the secondary Cisco 
7200 series router, thereby providing network redundancy. </div>
<a href="https://www.blogger.com/null" name="wp1036099"></a> 
   <div class="pB1_Body1">
 It is important to note that more than one 
router must be employed at HQ to provide resiliency. For VPN resilience,
 the remote site should be configured with two GRE tunnels, one to the 
primary HQ VPN router, and the other to the backup HQ VPN router. </div>
<a href="https://www.blogger.com/null" name="wp1036100"></a> 
   <div class="pB1_Body1">
 This section contains basic steps to configure a GRE tunnel and includes the following tasks: </div>
<a href="https://www.blogger.com/null" name="wp1036104"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036110">Configuring the Tunnel Interface, Source, and Destination</a> </div>
<a href="https://www.blogger.com/null" name="wp1036108"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036178">Verifying the Tunnel Interface, Source, and Destination</a> </div>
<a href="https://www.blogger.com/null" name="Configuring_the_Tunnel_Interface,_Source,_and_Destination"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036110"></a> 
   <a href="https://www.blogger.com/null" name="wpxref29735"></a> 
   <h3 class="p_H_Head3">
 Configuring the Tunnel Interface, Source, and Destination </h3>
<a href="https://www.blogger.com/null" name="wp1036114"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036111"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036112"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036113"></a> 
   <div class="pB1_Body1">
 To configure a GRE tunnel between the 
headquarters and remote office routers, you must configure a tunnel 
interface, source, and destination on the headquarters and remote office
 routers. To do this, complete the following steps starting in global 
configuration mode. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036115"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />The
 following procedure assumes the tunnel interface, source, and 
destination on the remote office router are configured with the values 
listed in <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035857">Table 3-1</a>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036172"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1036123table1036119" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1036121"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036123"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036125"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036127"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036130"></a><a href="https://www.blogger.com/null" name="wpmkr1036129"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold" style="font-weight: bold;">interface tunnel 0 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config-if)# </span><b class="cBold">ip address 172.17.3.3 
255.255.255.0
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036132"></a><div class="pB1_Body1">
 Specify a 
tunnel interface number, enter interface configuration mode, and 
configure an IP address and subnet mask on the tunnel interface. This 
example configures IP address and subnet mask 172.17.3.3 255.255.255.0 
for tunnel interface 0 on the headquarters router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036134"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036137"></a><a href="https://www.blogger.com/null" name="wpmkr1036136"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold">tunnel source 172.17.2.4 
255.255.255.0
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036139"></a><div class="pB1_Body1">
 Specify the 
tunnel interface source address and subnet mask. This example uses the 
IP address and subnet mask of T3 serial interface 1/0 of the 
headquarters router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036141"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036144"></a><a href="https://www.blogger.com/null" name="wpmkr1036143"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold">tunnel destination 
172.24.2.5 255.255.255.0
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036146"></a><div class="pB1_Body1">
 Specify the 
tunnel interface destination address. This example uses the IP address 
and subnet mask of T3 serial interface 1/0 of the remote office router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036148"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036151"></a><a href="https://www.blogger.com/null" name="wpmkr1036150"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold">tunnel mode gre ip
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036153"></a><div class="pB1_Body1">
 Configure GRE as the tunnel mode. </div>
<a href="https://www.blogger.com/null" name="wp1036154"></a><div class="pB1_Body1">
 GRE is the default tunnel encapsulation mode, so this command is considered optional. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036156"></a><div class="pCSN_CellStepnext">
 Step 5  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036158"></a><a href="https://www.blogger.com/null" name="wpmkr1036159"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold" style="font-weight: bold;">interface tunnel 0 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config-if)# </span><b class="cBold" style="font-weight: bold;">no shutdown 
</b><span style="color: black; font-style: normal; font-weight: normal;">%LINK-3-UPDOWN: Interface Tunnel0, changed state 
to up
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036164"></a><div class="pB1_Body1">
 Bring up the tunnel interface.<sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036163">1</a> </sup> </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036166"></a><div class="pCSN_CellStepnext">
 Step 6  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036168"></a><a href="https://www.blogger.com/null" name="wpmkr1036169"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold" style="font-weight: bold;">exit 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config)# </span><span style="color: black; font-style: normal; font-weight: bold;">ip r</span><code class="cExPlain">oute 10.1.4.0 
255.255.255.0 tunnel 0
</code></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036171"></a><div class="pB1_Body1">
 Exit back to 
global configuration mode and configure traffic from the remote office 
network through the tunnel. This example configures traffic from the 
remote office Fast Ethernet network (10.1.4.0 255.255.255.0) through GRE
 tunnel 0. </div>
</td> 
      </tr>
</tbody> 
    </table>
<table> 
     <tbody>
<tr> 
       <td><a href="https://www.blogger.com/null" name="wp1036163"></a><div class="pTFi_TableFootnoteIndent">
 <sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036164">1</a> </sup>This command changes the state of the tunnel interface from administratively down to up. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036174"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036173"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036175"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />When configuring GRE, you must have only Cisco routers or access servers at both ends of the tunnel connection. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Verifying_the_Tunnel_Interface,_Source,_and_Destination"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036178"></a> 
   <a href="https://www.blogger.com/null" name="wpxref35722"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036177"></a> 
   <h3 class="p_H_Head3">
 Verifying the Tunnel Interface, Source, and Destination </h3>
<a href="https://www.blogger.com/null" name="wp1036179"></a> 
   <div class="pB1_Body1">
 To verify the configuration: </div>
<a href="https://www.blogger.com/null" name="wp1036182"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036180"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036181"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the <b class="cBold">show interfaces tunnel 0</b>
 EXEC command to view the tunnel interface status, configured IP 
addresses, and encapsulation type. Both the interface and the interface 
line protocol should be "up." </div>
<a href="https://www.blogger.com/null" name="wp1052070"></a> 
   <div class="pEx2_Example2">
 
    <pre>ski03_7206#<span style="color: black; font-style: normal; font-weight: bold;">show interfaces tunnel 1
</span></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052071"></a> 
   <div class="pEx2_Example2">
 
    <pre>Tunnel1 is up, line protocol is up 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052072"></a> 
   <div class="pEx2_Example2">
 
    <pre>Hardware is Tunnel
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052073"></a> 
   <div class="pEx2_Example2">
 
    <pre>MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec, 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052074"></a> 
   <div class="pEx2_Example2">
 
    <pre>reliability 255/255, txload 1/255, rxload 1/255
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052075"></a> 
   <div class="pEx2_Example2">
 
    <pre>Encapsulation TUNNEL, loopback not set
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052076"></a> 
   <div class="pEx2_Example2">
 
    <pre>Keepalive not set
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052077"></a> 
   <div class="pEx2_Example2">
 
    <pre>Tunnel source 1101:1::1, destination 1501:1::1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052078"></a> 
   <div class="pEx2_Example2">
 
    <pre>Tunnel protocol/transport IPSEC/IPV6
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052079"></a> 
   <div class="pEx2_Example2">
 
    <pre>Tunnel TTL 255
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052080"></a> 
   <div class="pEx2_Example2">
 
    <pre>Tunnel transmit bandwidth 8000 (kbps)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052081"></a> 
   <div class="pEx2_Example2">
 
    <pre>Tunnel receive bandwidth 8000 (kbps)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052082"></a> 
   <div class="pEx2_Example2">
 
    <pre>Tunnel protection via IPSec (profile "tunpro")
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052083"></a> 
   <div class="pEx2_Example2">
 
    <pre>Last input 00:08:23, output 00:04:28, output hang never
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052084"></a> 
   <div class="pEx2_Example2">
 
    <pre>Last clearing of "show interface" counters never
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052085"></a> 
   <div class="pEx2_Example2">
 
    <pre>Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 3
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052086"></a> 
   <div class="pEx2_Example2">
 
    <pre>Queueing strategy: fifo
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052087"></a> 
   <div class="pEx2_Example2">
 
    <pre>Output queue: 0/0 (size/max)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052088"></a> 
   <div class="pEx2_Example2">
 
    <pre>5 minute input rate 0 bits/sec, 0 packets/sec
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052089"></a> 
   <div class="pEx2_Example2">
 
    <pre>5 minute output rate 0 bits/sec, 0 packets/sec
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052090"></a> 
   <div class="pEx2_Example2">
 
    <pre>39 packets input, 22734 bytes, 0 no buffer
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052091"></a> 
   <div class="pEx2_Example2">
 
    <pre>Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052092"></a> 
   <div class="pEx2_Example2">
 
    <pre>0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052093"></a> 
   <div class="pEx2_Example2">
 
    <pre>57 packets output, 30130 bytes, 0 underruns
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052094"></a> 
   <div class="pEx2_Example2">
 
    <pre>0 output errors, 0 collisions, 0 interface resets
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052095"></a> 
   <div class="pEx2_Example2">
 
    <pre>0 output buffer failures, 0 output buffers swapped out
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1036206"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036207"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Try pinging the tunnel interface of the remote office router (this example uses the IP address of tunnel interface 1 [172.24.3.6]): </div>
<a href="https://www.blogger.com/null" name="wp1036209"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036208"></a> 
   <div class="pEx2_Example2">
 
    <pre>hq-sanjose(config)# <b class="cBold">ping 172.24.3.6
</b></pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1036210"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036211"></a> 
   <div class="pEx2_Example2">
 
    <pre>Type escape sequence to abort.
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036212"></a> 
   <div class="pEx2_Example2">
 
    <pre>Sending 5, 100-byte ICMP Echos to 172.24.3.6, timeout is 2 seconds:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036213"></a> 
   <div class="pEx2_Example2">
 
    <pre>!!!!!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036215"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036214"></a> 
   <div class="pEx2_Example2">
 
    <pre>Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 ms
</pre>
</div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/tip.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036217"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036216"></a> 
   <div class="pTip">
 <b>Tip </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="8" />If you have trouble, make sure you are using the correct IP address and that you enabled the tunnel interface with the <b class="cBold">no shutdown</b> command. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Configuring_an_IPSec_Tunnel"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036221"></a> 
   <a href="https://www.blogger.com/null" name="wpxref33982"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036219"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036220"></a> 
   <h3 class="p_H_Head2">
 Configuring an IPSec Tunnel </h3>
<a href="https://www.blogger.com/null" name="wp1036222"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036223"></a> 
   <div class="pB1_Body1">
 IPSec can be configured in tunnel mode or transport mode. IPSec tunnel mode can be used as an alternative to a GRE tunnel, or in conjunction with a GRE tunnel. In IPSec tunnel mode, the entire original IP datagram is encrypted, and it becomes the payload in a new IP packet. This mode allows a network device, such as a router, to act as an IPSec proxy. That is, the router performs encryption on behalf of the hosts. The source router encrypts packets and forwards them along the IPSec tunnel. The destination router decrypts the original IP datagram and forwards it on to the destination system. Tunnel mode protects against traffic analysis; with tunnel mode, an attacker can only determine the tunnel endpoints and not the true source and destination of the packets passing through the tunnel, even if they are the same as the tunnel endpoints. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036226"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />IPSec tunnel mode configuration instructions are described in detail in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036799">"Configuring IPSec and IPSec Tunnel Mode" section</a>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036229"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036228"></a> 
   <div class="pB1_Body1">
 In IPSec transport mode, only the IP payload is encrypted, and the original IP headers are left intact. (See <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036240">Figure 3-6</a>.) This mode has the advantage of adding only a few bytes to each packet. It also allows devices on the public network to see the final source and destination of the packet. With this capability, you can enable special processing in the intermediate network based on the information in the IP header. However, the Layer 4 header will be encrypted, limiting the examination of the packet. Unfortunately, by passing the IP header in the clear, transport mode allows an attacker to perform some traffic analysis. (See the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036857">"Defining Transform Sets and Configuring IPSec Tunnel Mode" section</a> for an IPSec transport mode configuration example.) </div>
<a href="https://www.blogger.com/null" name="wp1036240"></a> 
   <a href="https://www.blogger.com/null" name="wpxref90756"></a> 
   <div class="pTC_TableCap">
 Figure 3-6 IPSec in Tunnel and Transport Modes </div>
<a href="https://www.blogger.com/null" name="wp1036244"></a> 
   <div class="pGraphicAnchor">
 </div>
<div align="left">
 
    <img border="0" hspace="0" id="wp1036242" src="http://www.cisco.com/c/dam/en/us/td/i/000001-100000/20001-25000/23001-23500/23246.ps/_jcr_content/renditions/23246.jpg" vspace="0" /> 
   </div>
<div class="pGraphicAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Step_2-Configuring_Network_Address_Translation"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036247"></a> 
   <a href="https://www.blogger.com/null" name="wpxref17682"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036246"></a> 
   <h2 class="p_H_Head1">
 Step 2—Configuring Network Address Translation </h2>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036248"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />NAT is used if you have conflicting private address spaces in the extranet scenario. If you have no conflicting private address spaces, proceed to the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036397">"Step 3—Configuring Encryption and IPSec" section</a>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036253"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036252"></a> 
   <div class="pB1_Body1">
 Network Address Translation (NAT) enables private IP internetworks with addresses that are not globally unique to connect to the Internet by translating those addresses into globally routable address space. NAT is configured on the router at the border of a stub domain (referred to as the <em class="cCi_CmdItalic">inside network</em>) and a public network such as the Internet (referred to as the <em class="cCi_CmdItalic">outside network</em>). NAT translates the internal local addresses to globally unique IP addresses before sending packets to the outside network. NAT also allows a more graceful renumbering strategy for organizations that are changing service providers or voluntarily renumbering into classless interdomain routing (CIDR) blocks. </div>
<a href="https://www.blogger.com/null" name="wp1036256"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036254"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036255"></a> 
   <div class="pB1_Body1">
 This section only explains how to configure <em class="cCi_CmdItalic">static translation </em>to translate internal local IP addresses into globally unique IP addresses before sending packets to an outside network, and includes the following tasks: </div>
<a href="https://www.blogger.com/null" name="wp1036260"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036313">Configuring Static Inside Source Address Translation</a> </div>
<a href="https://www.blogger.com/null" name="wp1036264"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036368">Verifying Static Inside Source Address Translation</a> </div>
<a href="https://www.blogger.com/null" name="wp1036265"></a> 
   <div class="pB1_Body1">
 <em class="cCi_CmdItalic">Static translation</em> establishes a one-to-one mapping between your internal local address and an inside global address. Static translation is useful when a host on the inside must be accessible by a fixed address from the outside. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036266"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />For detailed, additional configuration information on NAT—for example, instructions on how to configure <em class="cCi_CmdItalic">dynamic translation</em>—refer to the "Configuring IP Addressing" chapter in the N<span style="color: black; font-style: italic; font-weight: normal;">etwork Protocols Configuration Guide, Part 1</span>. NAT is also described in RFC 1631. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036269"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036268"></a> 
   <div class="pB1_Body1">
 NAT uses the following definitions: </div>
<a href="https://www.blogger.com/null" name="wp1036271"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036270"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><b class="cBold">Inside local address</b>—The IP address that is assigned to a host on the inside network. The address is probably not a legitimate IP address assigned by the Network Information Center (NIC) or service provider. </div>
<a href="https://www.blogger.com/null" name="wp1036273"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036272"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><b class="cBold">Inside global address</b>—A legitimate IP address (assigned by the NIC or service provider) that represents one or more inside local IP addresses to the outside world. </div>
<a href="https://www.blogger.com/null" name="wp1036275"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036274"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><b class="cBold">Outside local address</b>—The IP address of an outside host as it appears to the inside network. Not necessarily a legitimate address, it was allocated from address space routable on the inside. </div>
<a href="https://www.blogger.com/null" name="wp1036277"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036276"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><b class="cBold">Outside global address</b>—The IP address assigned to a host on the outside network by the host owner. The address was allocated from a globally routable address or network space. </div>
<a href="https://www.blogger.com/null" name="wp1036281"></a> 
   <div class="pB1_Body1">
 <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036284">Figure 3-7</a> illustrates a router that is translating a source address inside a network to a source address outside the network. </div>
<a href="https://www.blogger.com/null" name="wp1036284"></a> 
   <a href="https://www.blogger.com/null" name="wpxref36255"></a> 
   <div class="pTC_TableCap">
 Figure 3-7 NAT Inside Source Translation </div>
<a href="https://www.blogger.com/null" name="wp1036288"></a> 
   <div class="pGraphicAnchor">
 </div>
<div align="left">
 
    <img border="0" hspace="0" id="wp1036286" src="http://www.cisco.com/c/dam/en/us/td/i/000001-100000/20001-25000/24501-25000/24713.ps/_jcr_content/renditions/24713.jpg" vspace="0" /> 
   </div>
<div class="pGraphicAnchor">
 </div>
<a href="https://www.blogger.com/null" name="wp1036293"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036289"></a> 
   <div class="pB1_Body1">
 The following process describes inside source address translation, as shown in <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036284">Figure 3-7</a>: </div>
<a href="https://www.blogger.com/null" name="wp1036294"></a> 
   <div class="pNF_NumFirst">
 <b> 1. </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="10" />The user at Host 10.1.1.1 opens a connection to Host B. </div>
<a href="https://www.blogger.com/null" name="wp1036295"></a> 
   <div class="pNN_NumNext">
 <b> 2. </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="10" />The first packet that the router receives from Host 10.1.1.1 causes the router to check its NAT table. </div>
<a href="https://www.blogger.com/null" name="wp1036296"></a> 
   <div class="pB2_Body2">
 If a static translation entry was configured, the router goes to Step 3. </div>
<a href="https://www.blogger.com/null" name="wp1036297"></a> 
   <div class="pB2_Body2">
 If no translation entry exists, the router determines that source address (SA) 10.1.1.1 must be translated dynamically, selects a legal, global address from the dynamic address pool, and creates a translation entry. This type of entry is called a <em class="cCi_CmdItalic">simple entry</em>. </div>
<a href="https://www.blogger.com/null" name="wp1036298"></a> 
   <div class="pNN_NumNext">
 <b> 3. </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="10" />The router replaces the inside local source address of Host 10.1.1.1 with the translation entry global address, and forwards the packet. </div>
<a href="https://www.blogger.com/null" name="wp1036299"></a> 
   <div class="pNN_NumNext">
 <b> 4. </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="10" />Host B receives the packet and responds to Host 10.1.1.1 by using the inside global IP destination address (DA) 10.2.2.2. </div>
<a href="https://www.blogger.com/null" name="wp1036300"></a> 
   <div class="pNN_NumNext">
 <b> 5. </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="10" />When the router receives the packet with the inside global IP address, it performs a NAT table lookup by using the inside global address as a key. It then translates the address to the inside local address of Host 10.1.1.1 and forwards the packet to Host 10.1.1.1. </div>
<a href="https://www.blogger.com/null" name="wp1036301"></a> 
   <div class="pNN_NumNext">
 <b> 6. </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="10" />Host 10.1.1.1 receives the packet and continues the conversation. The router performs Steps 2 through 5 for each packet. </div>
<a href="https://www.blogger.com/null" name="wp1036302"></a> 
   <div class="pB1_Body1">
 This section contains the following topics: </div>
<a href="https://www.blogger.com/null" name="wp1036306"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036313">Configuring Static Inside Source Address Translation</a> </div>
<a href="https://www.blogger.com/null" name="wp1036310"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036368">Verifying Static Inside Source Address Translation</a> </div>
<a href="https://www.blogger.com/null" name="Configuring_Static_Inside_Source_Address_Translation"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036313"></a> 
   <a href="https://www.blogger.com/null" name="wpxref15733"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036312"></a> 
   <h3 class="p_H_Head2">
 Configuring Static Inside Source Address Translation </h3>
<a href="https://www.blogger.com/null" name="wp1040535"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1040534"></a> 
   <div class="pB1_Body1">
 To configure static inside source address translation, complete the following steps starting in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1040591"></a> 
   <div class="pTableAnchor">
 <span style="color: black; font-style: normal; font-weight: normal;"></span></div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1040606table1040602" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1040604"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1040606"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1040608"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1040610"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040613"></a><a href="https://www.blogger.com/null" name="wpmkr1040612"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">ip nat inside source static 
10.1.6.5 10.2.2.2
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040615"></a><div class="pB1_Body1">
 Establish static translation between an inside local address and an inside global address. This example translates inside local address 10.1.6.5 (the server) to inside global address 10.2.2.2. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1040617"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040620"></a><a href="https://www.blogger.com/null" name="wpmkr1040619"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">interface fastethernet 0/1
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040622"></a><div class="pB1_Body1">
 Specify the inside interface. This example specifies Fast Ethernet interface 0/1 on the headquarters router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1040624"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040627"></a><a href="https://www.blogger.com/null" name="wpmkr1040626"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold">ip nat inside
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040629"></a><div class="pB1_Body1">
 Mark the interface as connected to the inside. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1040631"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040633"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold">interface serial 2/0
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040635"></a><div class="pB1_Body1">
 Specify the outside interface. This example specifies serial interface 2/0 on the headquarters router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1040637"></a><div class="pCSN_CellStepnext">
 Step 5  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040640"></a><a href="https://www.blogger.com/null" name="wpmkr1040639"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold">ip nat outside
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040642"></a><div class="pB1_Body1">
 Mark the interface as connected to the outside. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1040644"></a><div class="pCSN_CellStepnext">
 Step 6  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040646"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold" style="font-weight: bold;">exit 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config)#
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1040648"></a><div class="pB1_Body1">
 Exit back to global configuration mode. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 <span style="color: black; font-style: normal; font-weight: normal;"></span> </div>
<a href="https://www.blogger.com/null" name="wp1040457"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1040458"></a> 
   <div class="pB1_Body1">
 The previous steps are the minimum you must configure for static inside source address translation. You could configure multiple inside and outside interfaces. </div>
<a href="https://www.blogger.com/null" name="Verifying_Static_Inside_Source_Address_Translation"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036368"></a> 
   <a href="https://www.blogger.com/null" name="wpxref30910"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036367"></a> 
   <h3 class="p_H_Head2">
 Verifying Static Inside Source Address Translation </h3>
<a href="https://www.blogger.com/null" name="wp1036369"></a> 
   <div class="pB1_Body1">
 To verify the configuration: </div>
<a href="https://www.blogger.com/null" name="wp1036371"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036370"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the <b class="cBold">show ip nat translations verbose</b> EXEC command to see the global and local address translations and to confirm static translation is configured. </div>
<a href="https://www.blogger.com/null" name="wp1036372"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show ip nat translations verbose
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036373"></a> 
   <div class="pEx1_Example1">
 
    <pre>Pro Inside global      Inside local       Outside local      Outside
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036374"></a> 
   <div class="pEx1_Example1">
 
    <pre>global
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036375"></a> 
   <div class="pEx1_Example1">
 
    <pre>--- 10.2.2.2           10.1.6.5            ---                ---
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036376"></a> 
   <div class="pEx1_Example1">
 
    <pre>    create 00:10:28, use 00:10:28, flags:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036377"></a> 
   <div class="pEx1_Example1">
 
    <pre>static
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1036378"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036379"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the <b class="cBold">show running-config</b> EXEC command to see the inside and outside interfaces, global and local address translations, and to confirm static translation is configured (display text has been omitted from the following sample output for clarity). </div>
<a href="https://www.blogger.com/null" name="wp1036380"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show running-config
</b></pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1036381"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036382"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface FastEthernet0/1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036383"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 10.1.6.5 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036384"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036385"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip nat inside
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1036386"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036387"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface serial2/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036388"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 172.16.2.2 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036389"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip nat outside
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1036390"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036392"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036391"></a> 
   <div class="pEx1_Example1">
 
    <pre>ip nat inside source static 10.1.6.5 10.2.2.2
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036394"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036393"></a> 
   <div class="pEx1_Example1">
 
     
   </div>
<a href="https://www.blogger.com/null" name="Step_3-Configuring_Encryption_and_IPSec"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036397"></a> 
   <a href="https://www.blogger.com/null" name="wpxref28085"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036396"></a> 
   <h2 class="p_H_Head1">
 Step 3—Configuring Encryption and IPSec </h2>
<a href="https://www.blogger.com/null" name="wp1036399"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036398"></a> 
   <div class="pB1_Body1">
 IPSec is a framework of open standards, developed by the Internet Engineering Task Force (IETF), that provides data confidentiality, data integrity, and data authentication between participating peers. IPSec provides these security services at the IP layer; it uses IKE to handle negotiation of protocols and algorithms based on local policy, and to generate the encryption and authentication keys to be used by IPSec. IPSec can be used to protect one or more data flows between a pair of hosts, between a pair of security Cisco 7200 series routers, or between a security Cisco 7200 series router and a host. </div>
<a href="https://www.blogger.com/null" name="wp1036401"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036400"></a> 
   <div class="pB1_Body1">
 IKE is a hybrid security protocol that implements Oakley and SKEME key exchanges inside the Internet Security Association and Key Management Protocol (ISAKMP) framework. While IKE can be used with other protocols, its initial implementation is with the IPSec protocol. IKE provides authentication of the IPSec peers, negotiates IPSec security associations, establishes IPSec keys, and provides IKE keepalives. IPSec can be configured without IKE, but IKE enhances IPSec by providing additional features, flexibility, ease of configuration for the IPSec standard, and keepalives, which are integral in achieving network resilience when configured with GRE. </div>
<a href="https://www.blogger.com/null" name="wp1036403"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036402"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036404"></a> 
   <div class="pB1_Body1">
 Certification authority (CA) interoperability is provided by the ISM in support of the IPSec standard. It permits Cisco IOS devices and CAs to communicate so that your Cisco IOS device can obtain and use digital certificates from the CA. Although IPSec can be implemented in your network without the use of a CA, using a CA provides manageability and scalability for IPSec. </div>
<a href="https://www.blogger.com/null" name="wp1036405"></a> 
   <div class="pB1_Body1">
 The CA must be properly configured to issue certificates. You must also configure the peers to obtain certificates from the CA. Configure this certificate support as described in the "Configuring Certification Authority Interoperability" chapter of the <span style="color: black; font-style: italic; font-weight: normal;">Cisco IOS</span> <span style="color: black; font-style: italic; font-weight: normal;">Security Configuration Guide </span>(see <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342prf.html#wpxref74569"><span class="cXRef_Color" style="font-weight: normal;">"Related Documentation" section on page xi</span></a> for additional information on how to access these documents. </div>
<a href="https://www.blogger.com/null" name="wp1036407"></a> 
   <div class="pB1_Body1">
 To provide encryption and IPSec tunneling services on a Cisco 7200 series router, you must complete the following tasks: </div>
<a href="https://www.blogger.com/null" name="wp1036411"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036454">Configuring IKE Policies</a> </div>
<a href="https://www.blogger.com/null" name="wp1036415"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036704">Verifying IKE Policies</a> </div>
<a href="https://www.blogger.com/null" name="wp1036419"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036799">Configuring IPSec and IPSec Tunnel Mode</a> </div>
<a href="https://www.blogger.com/null" name="wp1036423"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036915">Configuring Crypto Maps</a> </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036425"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036424"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />You can configure a static crypto map, create a dynamic crypto map, or add a dynamic crypto map into a static crypto map. Refer to the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036915">"Configuring Crypto Maps" section</a>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036429"></a> 
   <div class="pB1_Body1">
 Optionally, you can configure CA interoperability. This guide does not explain how to configure CA interoperability on your Cisco 7200 series router. Refer to the "IP Security and Encryption" part of the <span style="color: black; font-style: italic; font-weight: normal;">Security Configuration Guide</span> and the <span style="color: black; font-style: italic; font-weight: normal;">Cisco IOS Security Command Reference</span> publication for detailed information on configuring CA interoperabilty. See <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342prf.html#wpxref74569"><span class="cXRef_Color" style="font-weight: normal;">"Related Documentation" section on page xi</span></a> for additional information on how to access these publications. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1042391"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />This section only contains basic configuration information for enabling encryption and IPSec tunneling services. Refer to the "IP Security and Encryption" part of the Cisco IOS <span style="color: black; font-style: italic; font-weight: normal;">Security Configuration Guide</span> and the <span style="color: black; font-style: italic; font-weight: normal;">Security Command Reference</span> publications for detailed configuration information on IPSec, IKE, and CA. See <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342prf.html#wpxref74569"><span class="cXRef_Color" style="font-weight: normal;">"Related Documentation" section on page xi</span></a> for information on how to access these publications. <br /><br />Refer to the <span class="cXRef_Color" style="font-weight: normal;">Integrated Service Adapter and Integrated Service Module Installation and Configuration</span> publication for detailed configuration information on the ISM. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036435"></a> 
   <div class="pB1_Body1">
 This section contains the following topics: </div>
<a href="https://www.blogger.com/null" name="wp1036439"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036454">Configuring IKE Policies</a> </div>
<a href="https://www.blogger.com/null" name="wp1036443"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036704">Verifying IKE Policies</a> </div>
<a href="https://www.blogger.com/null" name="wp1036447"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036799">Configuring IPSec and IPSec Tunnel Mode</a> </div>
<a href="https://www.blogger.com/null" name="wp1036451"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036915">Configuring Crypto Maps</a> </div>
<a href="https://www.blogger.com/null" name="Configuring_IKE_Policies"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036454"></a> 
   <a href="https://www.blogger.com/null" name="wpxref46365"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036453"></a> 
   <h3 class="p_H_Head2">
 Configuring IKE Policies </h3>
<a href="https://www.blogger.com/null" name="wp1036456"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036455"></a> 
   <div class="pB1_Body1">
 Internet Key Exchange (IKE) is enabled by default. IKE does not have to be enabled for individual interfaces, but is enabled globally for all interfaces in the router. You must create IKE policies at each peer. An IKE policy defines a combination of security parameters to be used during the IKE negotiation. </div>
<a href="https://www.blogger.com/null" name="wp1036457"></a> 
   <div class="pB1_Body1">
 You can create multiple IKE policies, each with a different combination of parameter values. If you do not configure any IKE policies, the router uses the default policy, which is always set to the lowest priority, and which contains each parameter default value. </div>
<a href="https://www.blogger.com/null" name="wp1036458"></a> 
   <div class="pB1_Body1">
 For each policy that you create, you assign a unique priority (1 through 10,000, with 1 being the highest priority). You can configure multiple policies on each peer—but at least one of these policies must contain exactly the same encryption, hash, authentication, and Diffie-Hellman parameter values as one of the policies on the remote peer. If you do not specify a value for a parameter, the default value is assigned. </div>
<a href="https://www.blogger.com/null" name="wp1036460"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036459"></a> 
   <div class="pB1_Body1">
 IKE keepalives (or "hello packets") are required to detect a loss of connectivity, providing network resiliency. If your HQ employs more than two routers and utilizes IPSec, you can specify the length of keepalive packets or use the default time period of 10 seconds. To specify the interval length at which keepalive packets are to be sent, use the <span style="color: black; font-style: normal; font-weight: bold;">cry isakmp keepalive</span><span style="color: black; font-style: normal; font-weight: normal;"> </span>command, as exemplified in Step 2 of the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036481">"Creating IKE Policies" section</a>. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036465"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036464"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036466"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />The default policy and the default values for configured policies do not show up in the configuration when you issue a <b class="cBold">show running-config </b>EXEC<b class="cBold"> </b>command. Instead, to see the default policy and any default values within configured policies, use the <b class="cBold">show crypto isakmp policy</b> EXEC command. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036467"></a> 
   <div class="pB1_Body1">
 This section contains basic steps to configure IKE policies and includes the following tasks: </div>
<a href="https://www.blogger.com/null" name="wp1036471"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036481">Creating IKE Policies</a> </div>
<a href="https://www.blogger.com/null" name="wp1036475"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036553">Additional Configuration Required for IKE Policies</a> </div>
<a href="https://www.blogger.com/null" name="wp1036479"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036585">Configuring Pre-shared Keys</a> </div>
<a href="https://www.blogger.com/null" name="Creating_IKE_Policies"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036481"></a> 
   <a href="https://www.blogger.com/null" name="wpxref43249"></a> 
   <h3 class="p_H_Head3">
 Creating IKE Policies </h3>
<a href="https://www.blogger.com/null" name="wp1036483"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036482"></a> 
   <div class="pB1_Body1">
 To create an IKE policy, complete the following steps starting in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1036551"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1036488table1036484" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1036486"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036488"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036490"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036492"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036495"></a><a href="https://www.blogger.com/null" name="wpmkr1036494"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">crypto isakmp policy 1
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036497"></a><a href="https://www.blogger.com/null" name="wpmkr1036498"></a><div class="pB1_Body1">
 Enter config-isakmp command mode and identify the policy to create. (Each policy is uniquely identified by the priority number you assign.) This example configures policy 1. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036500"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036502"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">cry isakmp keepalive 12 2
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036504"></a><div class="pB1_Body1">
 Optional step: Specify the time interval of IKE keepalive packets (default is 10 seconds), and the retry interval when the keepalive packet failed. This example configures the keepalive interval for 12 seconds and the retry interval for 2 seconds. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036506"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036509"></a><a href="https://www.blogger.com/null" name="wpmkr1036508"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-isakmp)# </code><b class="cBold">encryption des
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036511"></a><div class="pB1_Body1">
 Specify the encryption algorithm—56-bit Data Encryption Standard (DES [<b class="cBold">des</b>]) or 168-bit Triple DES (<b class="cBold">3des</b>). This example configures the DES algorithm, which is the default. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036513"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036516"></a><a href="https://www.blogger.com/null" name="wpmkr1036515"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-isakmp)# </code><b class="cBold">hash sha
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036518"></a><div class="pB1_Body1">
 Specify the hash algorithm—Message Digest 5 (MD5 [<b class="cBold">md5</b>]) or Secure Hash Algorithm (SHA [<b class="cBold">sha</b>]). This example configures SHA, which is the default. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036520"></a><div class="pCSN_CellStepnext">
 Step 5  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036523"></a><a href="https://www.blogger.com/null" name="wpmkr1036522"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-isakmp)# </code><b class="cBold">authentication 
pre-share
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036525"></a><div class="pB1_Body1">
 Specify the authentication method—pre-shared keys (<b class="cBold">pre-share</b>), RSA<sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036529">1</a> </sup> encrypted nonces (<b class="cBold">rsa-encr</b>), or RSA signatures (<b class="cBold">rsa-slg</b>). This example configures pre-shared keys. The default is RSA signatures. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036531"></a><div class="pCSN_CellStepnext">
 Step 6  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036534"></a><a href="https://www.blogger.com/null" name="wpmkr1036533"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-isakmp)# </code><b class="cBold">group 1
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036537"></a><a href="https://www.blogger.com/null" name="wpmkr1036536"></a><div class="pB1_Body1">
 Specify the Diffie-Hellman group identifier—768-bit Diffie-Hellman (<b class="cBold">1</b>) or 1024-bit Diffie-Hellman (<b class="cBold">2</b>). This example configures 768-bit Diffie-Hellman, which is the default. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036539"></a><div class="pCSN_CellStepnext">
 Step 7  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036542"></a><a href="https://www.blogger.com/null" name="wpmkr1036541"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-isakmp)# </code><b class="cBold">lifetime 86400
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036544"></a><div class="pB1_Body1">
 Specify the security association's lifetime—in seconds. This example configures 86400 seconds (one day). </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036546"></a><div class="pCSN_CellStepnext">
 Step 8  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036548"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-isakmp)# </code><b class="cBold" style="font-weight: bold;">exit 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config)#
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036550"></a><div class="pB1_Body1">
 Exit back to global configuration mode. </div>
</td> 
      </tr>
</tbody> 
    </table>
<table> 
     <tbody>
<tr> 
       <td><a href="https://www.blogger.com/null" name="wp1036529"></a><a href="https://www.blogger.com/null" name="wpmkr1036528"></a><div class="pTFi_TableFootnoteIndent">
 <sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036525">1</a> </sup>RSA = Rivest, Shamir, and Adelman. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Additional_Configuration_Required_for_IKE_Policies"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036553"></a> 
   <a href="https://www.blogger.com/null" name="wpxref45314"></a> 
   <h3 class="p_H_Head3">
 Additional Configuration Required for IKE Policies </h3>
<a href="https://www.blogger.com/null" name="wp1036555"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036554"></a> 
   <div class="pB1_Body1">
 Depending on which authentication method you specify in your IKE policies, you need to complete an additional companion configuration before IKE and IPSec can successfully use the IKE policies. </div>
<a href="https://www.blogger.com/null" name="wp1036556"></a> 
   <div class="pB1_Body1">
 Each authentication method requires an additional companion configuration as follows: </div>
<a href="https://www.blogger.com/null" name="wp1036558"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036557"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />RSA signatures method: </div>
<a href="https://www.blogger.com/null" name="wp1036559"></a> 
   <div class="pB2_Body2">
 If you specify RSA signatures as the authentication method in a policy, you must configure the peers to obtain certificates from a certification authority (CA). (And, of course, the CA must be properly configured to issue the certificates.) Configure this certificate support as described in the "Configuring Certification Authority Interoperability" chapter of the<span style="color: black; font-style: italic; font-weight: normal;"> Cisco IOS Security Configuration Guide.</span> </div>
<a href="https://www.blogger.com/null" name="wp1036561"></a> 
   <div class="pB2_Body2">
 The certificates are used by each peer to securely exchange public keys. (RSA signatures require that each peer has the remote peer's public signature key.) When both peers have valid certificates, they will automatically exchange public keys with each other as part of any IKE negotiation in which RSA signatures are used. </div>
<a href="https://www.blogger.com/null" name="wp1036563"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036562"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />RSA encrypted nonces method: </div>
<a href="https://www.blogger.com/null" name="wp1036564"></a> 
   <div class="pB2_Body2">
 If you specify RSA encrypted nonces as the authentication method in a policy, you need to ensure that each peer has the other peers' public keys. </div>
<a href="https://www.blogger.com/null" name="wp1036565"></a> 
   <div class="pB2_Body2">
 Unlike RSA signatures, the RSA encrypted nonces method does not use certificates to exchange public keys. Instead, you ensure that each peer has the others' public keys by doing the following: </div>
<a href="https://www.blogger.com/null" name="wp1036566"></a> 
   <div class="pBu2_Bullet2">
 –<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="17" />Manually configure RSA keys as described in the "Configuring Internet Key Exchange Security Protocol" chapter of the <span style="color: black; font-style: italic; font-weight: normal;">Cisco IOS Security Configuration Guide.</span> </div>
<a href="https://www.blogger.com/null" name="wp1036568"></a> 
   <div class="pBu2_Bullet2">
 –<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="17" />Ensure that an IKE exchange using RSA signatures has already occurred between the peers. (The peers' public keys are exchanged during the RSA-signatures-based IKE negotiations.) </div>
<a href="https://www.blogger.com/null" name="wp1036569"></a> 
   <div class="pB3_Body3">
 To make this happen, specify two policies: a higher-priority policy with RSA encrypted nonces, and a lower-priority policy with RSA signatures. When IKE negotiations occur, RSA signatures will be used the first time because the peers do not yet have each others' public keys. Then, future IKE negotiations will be able to use RSA-encrypted nonces because the public keys will have been exchanged. </div>
<a href="https://www.blogger.com/null" name="wp1036570"></a> 
   <div class="pB3_Body3">
 Of course, this alternative requires that you have CA support configured. </div>
<a href="https://www.blogger.com/null" name="wp1036571"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Pre-shared keys authentication method: </div>
<a href="https://www.blogger.com/null" name="wp1036572"></a> 
   <div class="pB2_Body2">
 If you specify pre-shared keys as the authentication method in a policy, you must configure these pre-shared keys as described in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036585">"Configuring Pre-shared Keys" section</a>." </div>
<a href="https://www.blogger.com/null" name="wp1036577"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036576"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Digital certificate authentication method: </div>
<a href="https://www.blogger.com/null" name="wp1036578"></a> 
   <div class="pB2_Body2">
 If you specify digital certificates as the authentication method in a policy, the CA must be properly configured to issue certificates. You must also configure the peers to obtain certificates from the CA. Configure this certificate support as described in the "Configuring Certification Authority Interoperability" chapter of the <span style="color: black; font-style: italic; font-weight: normal;">Cisco IOS Security Configuration Guide.</span> </div>
<a href="https://www.blogger.com/null" name="wp1036580"></a> 
   <div class="pB2_Body2">
 Digital certificates simplify authentication. You need only enroll each peer with the CA, rather than manually configuring each peer to exchange keys. Cisco recommends using digital certificates in a network of more than 50 peers. </div>
<a href="https://www.blogger.com/null" name="wp1036581"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036582"></a> 
   <div class="pB1_Body1">
 If RSA encryption is configured and signature mode is negotiated, the peer will request both signature and encryption keys. Basically, the router will request as many keys as the configuration will support. If RSA encryption is not configured, it will just request a signature key. </div>
<a href="https://www.blogger.com/null" name="Configuring_Pre-shared_Keys"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036585"></a> 
   <a href="https://www.blogger.com/null" name="wpxref71000"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036584"></a> 
   <h3 class="p_H_Head3">
 Configuring Pre-shared Keys </h3>
<a href="https://www.blogger.com/null" name="wp1036587"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036586"></a> 
   <div class="pB1_Body1">
 To configure pre-shared keys, perform these steps at each peer that uses pre-shared keys in an IKE policy: </div>
<hr noshade="noshade" />
 
   <a href="https://www.blogger.com/null" name="wp1036588"></a> 
   <div class="pSF_StepFirst">
 <b>Step 1 </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="5" />Set each peer ISAKMP identity. Each peer identity should be set to either its host name or by its IP address. By default, a peer identity is set to its IP address. </div>
<a href="https://www.blogger.com/null" name="wp1036589"></a> 
   <div class="pSN_StepNext">
 <b>Step 2 </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="5" />Specify the shared keys at each peer. Note that a given pre-shared key is shared between two peers. At a given peer, you could specify the same key to share with multiple remote peers; however, a more secure approach is to specify different keys to share between different pairs of peers. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036596"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />The following procedure is based on the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035810">"Site-to-Site Scenario" section</a>. However, the same configuration commands can be used in an extranet scenario. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036598"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036597"></a> 
   <div class="pB1_Body1">
 To specify pre-shared keys at a peer, complete the following steps in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1036634"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1036603table1036599" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1036601"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036603"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036605"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036607"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036610"></a><a href="https://www.blogger.com/null" name="wpmkr1036609"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">crypto isakmp identity 
address
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036612"></a><div class="pB1_Body1">
 <b class="cBold">At the local peer</b>: Specify the ISAKMP identity (<b class="cBold">address o</b>r <b class="cBold">hostname</b>) the headquarters router will use when communicating with the remote office router during IKE negotiations. This example specifies the <b class="cBold">address</b> keyword, which uses IP address 172.17.2.4 (serial interface 1/0 of the headquarters router) as the identity for the headquarters router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036614"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036617"></a><a href="https://www.blogger.com/null" name="wpmkr1036616"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)#</code> <b class="cBold">crypto isakmp key test12345 
address 172.24.2.5
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036619"></a><div class="pB1_Body1">
 <b class="cBold">At the local peer</b>: Specify the shared key the headquarters router will use with the remote office router. This example configures the shared key test12345 to be used with the remote peer 172.24.2.5 (serial interface 1/0 on the remote office router). </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036621"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036624"></a><a href="https://www.blogger.com/null" name="wpmkr1036623"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">ro-rtp(config)#</code> <b class="cBold">crypto isakmp identity address
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036626"></a><div class="pB1_Body1">
 <b class="cBold">At the remote peer</b>: Specify the ISAKMP identity (<b class="cBold">address o</b>r <b class="cBold">hostname</b>) the remote office router will use when communicating with the headquarters router during IKE negotiations. Again, this example specifies the <b class="cBold">address</b> keyword, which uses IP address 172.24.2.5 (serial interface 1/0 of the remote office router) as the identity for the remote office router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036628"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036630"></a><a href="https://www.blogger.com/null" name="wpmkr1036631"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">ro-rtp(config)# </code><b class="cBold">crypto isakmp key test12345 
address 172.17.2.4
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036633"></a><div class="pB1_Body1">
 <b class="cBold">At the remote peer</b>: Specify the shared key to be used with the local peer. This is the same key you just specified at the local peer. This example configures the shared key test12345 to be used with the local peer 172.17.2.4 (serial interface 1/0 on the headquarters router). </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1046305"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1046303"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1046304"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1046306"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />Set an ISAKMP identity whenever you specify pre-shared keys. The <b class="cBold">address</b> keyword is typically used when there is only one interface (and therefore only one IP address) that will be used by the peer for IKE negotiations, and the IP address is known. Use the <b class="cBold">hostname</b> keyword if there is more than one interface on the peer that might be used for IKE negotiations, or if the interface IP address is unknown (such as with dynamically-assigned IP addresses). </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Configuring_the_Cisco_7200_Series_Router_for_Digital_Certificate_Interoperability"> </a> 
   <a href="https://www.blogger.com/null" name="wp1046307"></a> 
   <h3 class="p_H_Head3">
 Configuring the Cisco 7200 Series Router for Digital Certificate Interoperability </h3>
<a href="https://www.blogger.com/null" name="wp1046308"></a> 
   <div class="pB1_Body1">
 To configure your Cisco 7200 series router to use digital certificates as the authentication method, use the following steps, beginning in global configuration mode. This configuration assumes the use of the IOS default ISAKMP policy, which uses DES, SHA, RSA signatures, Diffie-Hellman group 1, and a lifetime of 86,400 seconds. Cisco recommends using 3DES. Refer to the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036481">"Creating IKE Policies" section</a> for an ISAKMP configuration example which specifies 3DES as the encryption method. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036644"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />This example only configures the head-end Cisco 7200 series router. Additionally, each peer must be enrolled with a CA. This configuration example does not configure the CA. CA configuration instructions should be obtained from your CA vendor. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036701"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1036649table1036645" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1036647"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036649"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036651"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036653"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036655"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold" style="font-style: normal; font-weight: bold;">crypto ca identity </b><span style="color: black; font-style: oblique; font-weight: normal;">name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036657"></a><div class="pB1_Body1">
 <span style="color: black; font-style: normal; font-weight: normal;">Declares a CA. The name should be the domain name of the CA. This command puts you into the ca-identity configuration mode.</span> </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036659"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036661"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)#</code> <span style="color: black; font-style: normal; font-weight: bold;">enrollment url </span><span style="color: black; font-style: oblique; font-weight: normal;">url
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036663"></a><div class="pB1_Body1">
 Specifies the URL of the CA. (The URL should include any nonstandard cgi-bin script location.) </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036665"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036667"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)#</code> <b class="cBold">enrollment mode ra
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036669"></a><div class="pB1_Body1">
 <span style="color: black; font-style: normal; font-weight: normal;">(Optional) Specifies RA mode if your CA system provides a registration authority (RA).</span> </div>
<a href="https://www.blogger.com/null" name="wp1036670"></a><div class="pB1_Body1">
 <span style="color: black; font-style: normal; font-weight: normal;">The Cisco IOS software automatically determines the mode—RA or non-RA; therefore, if RA mode is used, this subcommand is written to NVRAM during "write memory."</span> </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036672"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036674"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(ca-identity)# </code><b class="cBold" style="font-style: normal; font-weight: bold;">query url </b><span style="color: black; font-style: oblique; font-weight: normal;">url
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036676"></a><div class="pB1_Body1">
 Specifies the location of the LDAP server if your CA system provides an RA and supports the LDAP protocol. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036678"></a><div class="pCSN_CellStepnext">
 Step 5  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036680"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(ca-identity)# </code><span style="color: black; font-style: normal; font-weight: bold;">enrollment retry period</span><span style="color: black; font-style: normal; font-weight: normal;"> 
</span><span style="color: black; font-style: oblique; font-weight: normal;">minutes
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036682"></a><div class="pB1_Body1">
 (Optional) Specifies that other peer certificates can still be accepted by your router even if the appropriate CRL is not accessible to your router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036684"></a><div class="pCSN_CellStepnext">
 Step 6  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036686"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(ca-identity)# </code><span style="color: black; font-style: normal; font-weight: bold;">enrollment retry count</span><span style="color: black; font-style: normal; font-weight: normal;"> 
</span><span style="color: black; font-style: oblique; font-weight: normal;">number
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036688"></a><div class="pB1_Body1">
 (Optional) Specifies how many times the router will continue to send unsuccessful certificate requests before giving up. By default, the router will never give up trying. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036690"></a><div class="pCSN_CellStepnext">
 Step 7  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036692"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(ca-identity)# </code><span style="color: black; font-style: normal; font-weight: bold;">crl optional
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036694"></a><div class="pB1_Body1">
 (Optional) Specifies that other peers certificates can still be accepted by your router even if the appropriate CRL is not accessible to your router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036696"></a><div class="pCSN_CellStepnext">
 Step 8  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036698"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(ca-identity)# </code><span style="color: black; font-style: normal; font-weight: bold;">exit
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036700"></a><div class="pB1_Body1">
 Exits ca-identity configuration mode. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Verifying_IKE_Policies"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036704"></a> 
   <a href="https://www.blogger.com/null" name="wpxref69312"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036703"></a> 
   <h3 class="p_H_Head2">
 Verifying IKE Policies </h3>
<a href="https://www.blogger.com/null" name="wp1036705"></a> 
   <div class="pB1_Body1">
 To verify the configuration: </div>
<a href="https://www.blogger.com/null" name="wp1036708"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036706"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036707"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the <b class="cBold">show crypto isakmp policy</b> EXEC command to see the default policy and any default values within configured policies. </div>
<a href="https://www.blogger.com/null" name="wp1036709"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show crypto isakmp policy
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036710"></a> 
   <div class="pEx1_Example1">
 
    <pre>Protection suite priority 1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036711"></a> 
   <div class="pEx1_Example1">
 
    <pre> encryption algorithm: DES - Data Encryption Standard (56 bit keys)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036712"></a> 
   <div class="pEx1_Example1">
 
    <pre> hash algorithm: Secure Hash Standard
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036713"></a> 
   <div class="pEx1_Example1">
 
    <pre> authentication method: Pre-Shared Key
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036714"></a> 
   <div class="pEx1_Example1">
 
    <pre> Diffie-Hellman group: #1 (768 bit)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036715"></a> 
   <div class="pEx1_Example1">
 
    <pre> lifetime: 86400 seconds, no volume limit
</pre>
</div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036716"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />Although the above output shows "no volume limit" for the lifetime, you can currently only configure a time lifetime (such as 86400 seconds); volume limit lifetimes are not configurable. </div>
<hr class="Cautn1table" />
 
   <div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/tip.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1052579"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1052574"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1052575"></a> 
   <div class="pTip">
 <b>Tip </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="8" />If you have trouble, use the <b class="cBold">show version</b> command to ensure your Cisco 7200 series router is running a Cisco IOS software image that supports crypto. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1052580"></a> 
   <div class="pEx1_Example1">
 
    <pre>ski03_7206#<span style="color: black; font-style: normal; font-weight: bold;">show version
</span></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1052581"></a> 
   <div class="pEx1_Example1">
 
    <pre>Cisco Internetwork Operating System Software 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051093"></a> 
   <div class="pEx1_Example1">
 
    <pre>IOS (tm) 7200 Software (C7200-JK9O3S-M), Version 12.3(3), RELEASE SOFTWARE (fc1)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051094"></a> 
   <div class="pEx1_Example1">
 
    <pre>Copyright (c) 1986-2003 by cisco Systems, Inc.
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051095"></a> 
   <div class="pEx1_Example1">
 
    <pre>Compiled Mon 28-Jul-03 15:45 by dchih
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051096"></a> 
   <div class="pEx1_Example1">
 
    <pre>Image text-base: 0x60008954, data-base: 0x6219E000
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051097"></a> 
   <div class="pEx1_Example1">
 
    <pre>ROM: System Bootstrap, Version 12.1(20000710:044039) [nlaw-121E_npeb 117], DEVELOPMENT 
SOFTWARE
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051098"></a> 
   <div class="pEx1_Example1">
 
    <pre>BOOTLDR: 7200 Software (C7200-KBOOT-M), Version 12.1(8a)E, EARLY DEPLOYMENT RELEASE 
SOFTWARE (fc1)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051099"></a> 
   <div class="pEx1_Example1">
 
    <pre>m5-7206 uptime is 0 minutes
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051100"></a> 
   <div class="pEx1_Example1">
 
    <pre>System returned to ROM by reload at 22:20:24 UTC Wed Aug 13 2003
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051101"></a> 
   <div class="pEx1_Example1">
 
    <pre>System image file is "tftp://17.8.16.70/images/c7200-jk9o3s-mz.123-3"
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051102"></a> 
   <div class="pEx1_Example1">
 
    <pre>Last reload reason: Reload command
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051103"></a> 
   <div class="pEx1_Example1">
 
    <pre>This product contains cryptographic features and is subject to United
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051104"></a> 
   <div class="pEx1_Example1">
 
    <pre>States and local country laws governing import, export, transfer and
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051105"></a> 
   <div class="pEx1_Example1">
 
    <pre>use. Delivery of Cisco cryptographic products does not imply
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051106"></a> 
   <div class="pEx1_Example1">
 
    <pre>third-party authority to import, export, distribute or use encryption.
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051107"></a> 
   <div class="pEx1_Example1">
 
    <pre>Importers, exporters, distributors and users are responsible for
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051108"></a> 
   <div class="pEx1_Example1">
 
    <pre>compliance with U.S. and local country laws. By using this product you
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051109"></a> 
   <div class="pEx1_Example1">
 
    <pre>agree to comply with applicable laws and regulations. If you are unable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051110"></a> 
   <div class="pEx1_Example1">
 
    <pre>to comply with U.S. and local laws, return this product immediately.
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051111"></a> 
   <div class="pEx1_Example1">
 
    <pre>A summary of U.S. laws governing Cisco cryptographic products may be found at:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051112"></a> 
   <div class="pEx1_Example1">
 
    <pre>http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051113"></a> 
   <div class="pEx1_Example1">
 
    <pre>If you require further assistance please contact us by sending email to
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051114"></a> 
   <div class="pEx1_Example1">
 
    <pre>export@cisco.com.
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051115"></a> 
   <div class="pEx1_Example1">
 
    <pre>cisco 7206VXR (NPE400) processor (revision A) with 229376K/32768K bytes of memory.
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051116"></a> 
   <div class="pEx1_Example1">
 
    <pre>Processor board ID 21281666
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051117"></a> 
   <div class="pEx1_Example1">
 
    <pre>R7000 CPU at 350Mhz, Implementation 39, Rev 3.2, 256KB L2, 4096KB L3 Cache
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051118"></a> 
   <div class="pEx1_Example1">
 
    <pre>6 slot VXR midplane, Version 2.1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051119"></a> 
   <div class="pEx1_Example1">
 
    <pre>Last reset from power-on
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051120"></a> 
   <div class="pEx1_Example1">
 
    <pre>Bridging software.
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051121"></a> 
   <div class="pEx1_Example1">
 
    <pre>X.25 software, Version 3.0.0.
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051122"></a> 
   <div class="pEx1_Example1">
 
    <pre>SuperLAT software (copyright 1990 by Meridian Technology Corp).
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051123"></a> 
   <div class="pEx1_Example1">
 
    <pre>TN3270 Emulation software.
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051124"></a> 
   <div class="pEx1_Example1">
 
    <pre>PCI bus mb0_mb1 has 640 bandwidth points
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051125"></a> 
   <div class="pEx1_Example1">
 
    <pre>PCI bus mb2 has 270 bandwidth points
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051126"></a> 
   <div class="pEx1_Example1">
 
    <pre>WARNING: PCI bus mb0_mb1 Exceeds 600 bandwidth points
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051127"></a> 
   <div class="pEx1_Example1">
 
    <pre>4 Ethernet/IEEE 802.3 interface(s)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051128"></a> 
   <div class="pEx1_Example1">
 
    <pre>2 FastEthernet/IEEE 802.3 interface(s)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051129"></a> 
   <div class="pEx1_Example1">
 
    <pre>2 Serial network interface(s)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051130"></a> 
   <div class="pEx1_Example1">
 
    <pre>1 ATM network interface(s)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051131"></a> 
   <div class="pEx1_Example1">
 
    <pre>1 Integrated service adapter(s)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051132"></a> 
   <div class="pEx1_Example1">
 
    <pre>125K bytes of non-volatile configuration memory.
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051133"></a> 
   <div class="pEx1_Example1">
 
    <pre>125440K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes).
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1051134"></a> 
   <div class="pEx1_Example1">
 
    <pre>8192K bytes of Flash internal SIMM (Sector size 256K).
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1050725"></a> 
   <div class="pEx1_Example1">
 
    <pre>Configuration register is 0x0 
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1050726"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="Configuring_a_Different_Shared_Key"> </a> 
   <a href="https://www.blogger.com/null" name="wp1050178"></a> 
   <a href="https://www.blogger.com/null" name="wpxref86536"></a> 
   <h3 class="p_H_Head3">
 Configuring a Different Shared Key </h3>
<a href="https://www.blogger.com/null" name="wp1050182"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1050179"></a> 
   <div class="pB1_Body1">
 Because pre-shared keys were specified as the authentication method for policy 1 in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036454">"Configuring IKE Policies" section</a>, (the policy that will also be used on the business partner router) complete the following steps at the headquarters router as well as the business partner router: </div>
<hr noshade="noshade" />
 
   <a href="https://www.blogger.com/null" name="wp1036755"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036754"></a> 
   <div class="pSF_StepFirst">
 <b>Step 1 </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="5" />Set each peer Internet Security Association & Key Management Protocol (ISAKMP) identity. Each peer identity should be set to either its host name or by its IP address. By default, a peer identity is set to its IP address. In this scenario, you only need to complete this task at the <span style="color: black; font-style: italic; font-weight: normal;">business partner</span> router. </div>
<a href="https://www.blogger.com/null" name="wp1036756"></a> 
   <div class="pSN_StepNext">
 <b>Step 2 </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="5" />Specify the shared keys at each peer. Note that a given pre-shared key is shared between two peers. At a given peer, you could specify the same key to share with multiple remote peers; however, a more secure approach is to specify different keys to share between different pairs of peers. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036763"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />The following procedure is based on the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1035933">"Extranet Scenario" section</a>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036765"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036764"></a> 
   <div class="pB1_Body1">
 To configure a different pre-shared key for use between the headquarters router and the business partner router, complete the following steps in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1036795"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1036770table1036766" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1036768"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036770"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036772"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036774"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036777"></a><a href="https://www.blogger.com/null" name="wpmkr1036776"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)#</code> <b class="cBold">crypto isakmp key test67890  
address 172.23.2.7
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036779"></a><div class="pB1_Body1">
 <b class="cBold">At the local peer</b>: Specify the shared key the headquarters router will use with the business partner router. This example configures the shared key test67890 to be used with the remote peer 172.23.2.7 (serial interface 1/0 on the business partner router). </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036781"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036783"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">bus-ptnr(config)#</code> <b class="cBold">crypto isakmp identity address
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036785"></a><div class="pB1_Body1">
 <b class="cBold">At the remote peer</b>: Specify the ISAKMP identity (<b class="cBold">address o</b>r <b class="cBold">hostname</b>) the business partner router will use when communicating with the headquarters router during IKE negotiations. (This task was already completed on the headquarters router when policy 1 was configured in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036454">"Configuring IKE Policies" section</a>.) This example specifies the <b class="cBold">address</b> keyword, which uses IP address 172.23.2.7 (serial interface 1/0 of the business partner router) as the identity for the business partner router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036790"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036792"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">bus-ptnr(config)# </code><b class="cBold">crypto isakmp key test67890 
address 172.17.2.4
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036794"></a><div class="pB1_Body1">
 <b class="cBold">At the remote peer</b>: Specify the shared key to be used with the local peer. This is the same key you just specified at the local peer. This example configures the shared key test67890 to be used with the local peer 172.16.2.2 (serial interface 2/0 on the headquarters router). </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036796"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036797"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />Set an ISAKMP identity whenever you specify pre-shared keys. The <b class="cBold">address</b> keyword is typically used when there is only one interface (and therefore only one IP address) that will be used by the peer for IKE negotiations, and the IP address is known. Use the <b class="cBold">hostname</b> keyword if there is more than one interface on the peer that might be used for IKE negotiations, or if the interface IP address is unknown (such as with dynamically-assigned IP addresses). </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Configuring_IPSec_and_IPSec_Tunnel_Mode"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036799"></a> 
   <a href="https://www.blogger.com/null" name="wpxref28216"></a> 
   <h3 class="p_H_Head2">
 Configuring IPSec and IPSec Tunnel Mode </h3>
<a href="https://www.blogger.com/null" name="wp1036801"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036800"></a> 
   <div class="pB1_Body1">
 After you have configured a different shared key, configure IPSec at each participating IPSec peer. This section contains basic steps to configure IPSec and includes the following tasks: </div>
<a href="https://www.blogger.com/null" name="wp1036805"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036823">Creating Crypto Access Lists</a> </div>
<a href="https://www.blogger.com/null" name="wp1036809"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036847">Verifying Crypto Access Lists</a> </div>
<a href="https://www.blogger.com/null" name="wp1036813"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036857">Defining Transform Sets and Configuring IPSec Tunnel Mode</a> </div>
<a href="https://www.blogger.com/null" name="wp1036817"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036901">Verifying Transform Sets and IPSec Tunnel Mode</a> </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036819"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036818"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036820"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />IKE uses User Datagram Protocol (UDP) port 500. The IPSec encapsulating security payload (ESP) and authentication header (AH) protocols use IP protocol numbers 50 and 51. Ensure that your access lists are configured so that IP protocol 50, 51, and UDP port 500 traffic is not blocked at interfaces used by IPSec. In some cases, you might need to add a statement to your access lists to explicitly permit this traffic. Crypto access lists use the same format as standard access lists. However, the <span style="color: black; font-style: normal; font-weight: bold;">permit</span> command instructs the router to encrypt data, and the <span style="color: black; font-style: normal; font-weight: bold;">deny</span> command instructs the router to allow unencrypted data. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Creating_Crypto_Access_Lists"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036823"></a> 
   <a href="https://www.blogger.com/null" name="wpxref26732"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036822"></a> 
   <h3 class="p_H_Head3">
 Creating Crypto Access Lists </h3>
<a href="https://www.blogger.com/null" name="wp1036824"></a> 
   <div class="pB1_Body1">
 Crypto access lists are used to define which IP traffic will be protected by crypto and which traffic will not be protected by crypto. (These access lists are <em class="cEmphasis">not</em> the same as regular access lists, which determine what traffic to forward or block at an interface.) For example, you can create access lists to protect all IP traffic between the headquarters router and business partner router. </div>
<a href="https://www.blogger.com/null" name="wp1036826"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036825"></a> 
   <div class="pB1_Body1">
 The access lists themselves are not specific to IPSec. It is the crypto map entry referencing the specific access list that defines whether IPSec processing is applied to the traffic matching a <b class="cBold">permit</b> in the access list. </div>
<a href="https://www.blogger.com/null" name="wp1036828"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036827"></a> 
   <div class="pB1_Body1">
 To create a crypto access list, enter the following command in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1036844"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" id="wp1036831table1036829" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036831"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036833"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036836"></a><a href="https://www.blogger.com/null" name="wpmkr1036835"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">access-list 111 permit 
ip host 10.2.2.2 host 10.1.5.3
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036838"></a><div class="pB1_Body1">
 Specify conditions to determine which IP packets are protected.<sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036841">1</a> </sup> (Enable or disable crypto for traffic that matches these conditions.) This example configures access list 111 to encrypt all IP traffic between the headquarters server (translated inside global IP address 10.2.2.2) and PC B (IP address 10.1.5.3) in the business partner office. </div>
<a href="https://www.blogger.com/null" name="wp1036843"></a><div class="pB1_Body1">
 We recommend that you configure "mirror image" crypto access lists for use by IPSec and that you avoid using the <b class="cBold">any</b> keyword. </div>
</td> 
      </tr>
</tbody> 
    </table>
<table> 
     <tbody>
<tr> 
       <td><a href="https://www.blogger.com/null" name="wp1036841"></a><a href="https://www.blogger.com/null" name="wpmkr1036842"></a><div class="pTF_tableFootnote">
 <sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036838">1</a> </sup>You specify conditions using an IP access list designated by either a number or a name. The <b class="cBold">access-list</b> command designates a numbered extended access list; the <b class="cBold">ip access-list extended</b> command designates a named access list. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<br /> 
   <div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Verifying_Crypto_Access_Lists"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036847"></a> 
   <a href="https://www.blogger.com/null" name="wpxref35813"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036846"></a> 
   <h3 class="p_H_Head3">
 Verifying Crypto Access Lists </h3>
<a href="https://www.blogger.com/null" name="wp1036848"></a> 
   <div class="pB1_Body1">
 To verify the configuration: </div>
<a href="https://www.blogger.com/null" name="wp1036850"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036849"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the <b class="cBold">show access-lists 111 </b>EXEC command to see the access list attributes. </div>
<a href="https://www.blogger.com/null" name="wp1036851"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show access-lists 111
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036852"></a> 
   <div class="pEx1_Example1">
 
    <pre>Extended IP access list 111
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036853"></a> 
   <div class="pEx1_Example1">
 
    <pre>    permit ip host 10.2.2.2 host 10.1.5.3
</pre>
</div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/tip.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036854"></a> 
   <div class="pTip">
 <b>Tip </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="8" />If you have trouble, make sure you are specifying the correct access list number. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Defining_Transform_Sets_and_Configuring_IPSec_Tunnel_Mode"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036857"></a> 
   <a href="https://www.blogger.com/null" name="wpxref40826"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036856"></a> 
   <h3 class="p_H_Head3">
 Defining Transform Sets and Configuring IPSec Tunnel Mode </h3>
<a href="https://www.blogger.com/null" name="wp1036858"></a> 
   <div class="pB1_Body1">
 You must define transform sets regardless of the tunneling protocol you use. To define a transform set and configure IPSec tunnel mode, complete the following steps starting in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1036895"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1036863table1036859" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1036861"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036863"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036865"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036867"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036870"></a><a href="https://www.blogger.com/null" name="wpmkr1036869"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">crypto ipsec transform-set 
proposal4 ah-sha-hmac esp-des
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036872"></a><div class="pB1_Body1">
 Define a transform set and enter crypto-transform configuration mode. This example combines AH<sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036876">1</a> </sup> transform ah-sha-hmac, ESP<sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036880">2</a> </sup> encryption transform esp-des, and ESP authentication transform esp-sha-hmac in the transform set proposal4. </div>
<a href="https://www.blogger.com/null" name="wp1036881"></a><div class="pB1_Body1">
 There are complex rules defining which entries you can use for the transform arguments. These rules are explained in the command description for the <b class="cBold">crypto ipsec transform-set</b> command. You can also use the <b class="cBold">crypto ipsec transform-set? </b>command, in global configuration mode, to view the available transform arguments. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036883"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036886"></a><a href="https://www.blogger.com/null" name="wpmkr1036885"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(cfg-crypto-trans)# </code><b class="cBold">mode tunnel
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036888"></a><div class="pB1_Body1">
 Change the mode associated with the transform set. The mode setting is only applicable to traffic whose source and destination addresses are the IPSec peer addresses; it is ignored for all other traffic. (All other traffic is in tunnel mode only.) This example configures tunnel mode for the transport set proposal4, which creates an IPSec tunnel between the IPSec peer addresses. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036890"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036892"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(cfg-crypto-trans)# </code><b class="cBold" style="font-weight: bold;">exit 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config)#
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036894"></a><div class="pB1_Body1">
 Exit back to global configuration mode. </div>
</td> 
      </tr>
</tbody> 
    </table>
<table> 
     <tbody>
<tr> 
       <td><a href="https://www.blogger.com/null" name="wp1036876"></a><a href="https://www.blogger.com/null" name="wpmkr1036875"></a><div class="pTFi_TableFootnoteIndent">
 <sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036872">1</a> </sup>AH = authentication header. This header, when added to an IP datagram, ensures the integrity and authenticity of the data, including the invariant fields in the outer IP header. It does not provide confidentiality protection. AH uses a keyed-hash function rather than digital signatures. </div>
<a href="https://www.blogger.com/null" name="wp1036880"></a><a href="https://www.blogger.com/null" name="wpmkr1036879"></a><div class="pTFi_TableFootnoteIndent">
 <sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036872">2</a> </sup>ESP = encapsulating security payload. This header, when added to an IP datagram, protects the confidentiality, integrity, and authenticity of the data. If ESP is used to validate data integrity, it does not include the invariant fields in the IP header. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1036897"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036896"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />AH and ESP can be used independently or together, although for most applications just one of them is sufficient. For both of these protocols, IPSec does not define the specific security algorithms to use, but rather, provides an open framework for implementing industry-standard algorithms. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Verifying_Transform_Sets_and_IPSec_Tunnel_Mode"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036901"></a> 
   <a href="https://www.blogger.com/null" name="wpxref16971"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036899"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036900"></a> 
   <h3 class="p_H_Head3">
 Verifying Transform Sets and IPSec Tunnel Mode </h3>
<a href="https://www.blogger.com/null" name="wp1036902"></a> 
   <div class="pB1_Body1">
 To verify the configuration: </div>
<a href="https://www.blogger.com/null" name="wp1036904"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036903"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the <b class="cBold">show crypto ipsec transform-set </b>EXEC command to see the type of transform set configured on the router. </div>
<a href="https://www.blogger.com/null" name="wp1036905"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show crypto ipsec transform-set
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036906"></a> 
   <div class="pEx1_Example1">
 
    <pre>Transform set proposal4: { ah-sha-hmac  }
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036907"></a> 
   <div class="pEx1_Example1">
 
    <pre>   will negotiate = { Tunnel,  },
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036908"></a> 
   <div class="pEx1_Example1">
 
    <pre>   { esp-des esp-sha-hmac  }
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036909"></a> 
   <div class="pEx1_Example1">
 
    <pre>   will negotiate = { Tunnel,  },
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1036910"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1036912"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036911"></a> 
   <div class="pEx1_Example1">
 
    <pre>  -Display text omitted-
</pre>
</div>
<a href="https://www.blogger.com/null" name="Configuring_Crypto_Maps"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036915"></a> 
   <a href="https://www.blogger.com/null" name="wpxref87535"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036914"></a> 
   <h3 class="p_H_Head2">
 Configuring Crypto Maps </h3>
<a href="https://www.blogger.com/null" name="wp1036916"></a> 
   <div class="pB1_Body1">
 Remote devices need to be managed through a VPN from the central site when operating on a centralized IT model. VPN devices support numerous configuration options to determine the tunnel endpoint and, depending on the method chosen, these options may impact the manageability of the network. Refer to the <a href="http://www.cisco.com/c/en/CCIMO/TD/-Migration/security/vpn_modules/6342/configuration/guide/6342CH2.html#wpxref66587"><span class="cXRef_Color" style="font-weight: normal;">"Dynamic versus Static Crypto Maps" section on page 2-5</span></a> for a discussion of when to use static or dynamic crypto maps. </div>
<a href="https://www.blogger.com/null" name="wp1036920"></a> 
   <div class="pB1_Body1">
 To be the most effective in managing remote devices, you must use static cryptographic maps at the site where your management applications are located. Dynamic cryptographic maps can be used at the headend for ease of configuration. Dynamic maps, however, accept only incoming IKE requests, and because dynamic maps cannot initiate an IKE request, it is not always guaranteed that a tunnel exists between the remote device and the headend site. Static cryptographic map configuration includes the static IP addresses of the remote peers. Thus, remote sites must use static IP addresses to support remote management. </div>
<a href="https://www.blogger.com/null" name="wp1036921"></a> 
   <div class="pB1_Body1">
 For IPSec to succeed between two IPSec peers, both peer crypto map entries must contain compatible configuration statements. </div>
<a href="https://www.blogger.com/null" name="wp1036923"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036922"></a> 
   <div class="pB1_Body1">
 When two peers try to establish a security association (SA), they must each have at least one crypto map entry that is compatible with one of the other peer crypto map entries. For two crypto map entries to be compatible, they must meet the following minimum criteria: </div>
<a href="https://www.blogger.com/null" name="wp1036925"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036924"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />The crypto map entries must contain compatible crypto access lists (for example, mirror image access lists). In the case where the responding peer is using dynamic crypto maps, the entries in the local crypto access list must be "permitted" by the peer crypto access list. </div>
<a href="https://www.blogger.com/null" name="wp1036926"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />The crypto map entries must each identify the other peer (unless the responding peer is using dynamic crypto maps). </div>
<a href="https://www.blogger.com/null" name="wp1036928"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036927"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />The crypto map entries must have at least one transform set in common. </div>
<a href="https://www.blogger.com/null" name="wp1036930"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036929"></a> 
   <div class="pB1_Body1">
 When IKE is used to establish SAs, the IPSec peers can negotiate the settings they will use for the new SAs. This means that you can specify lists (such as lists of acceptable transforms) within the crypto map entry. </div>
<a href="https://www.blogger.com/null" name="wp1036931"></a> 
   <div class="pB1_Body1">
 After you have completed configuring IPSec at each participating IPSec peer, configure crypto map entries and apply the crypto maps to interfaces. </div>
<a href="https://www.blogger.com/null" name="wp1036933"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036932"></a> 
   <div class="pB1_Body1">
 The task of configuring IPSec at each peer can be eased by utilizing dynamic crypto maps. By configuring the head-end Cisco 7200 series router with a dynamic map, and the peers with a static map, the peer will be permitted to establish an IPSec security association even though <span style="color: black; font-style: normal; font-weight: normal;">th</span>e router does not have a crypto map entry specifically configured to meet all of the remote peer requirements. </div>
<a href="https://www.blogger.com/null" name="wp1036934"></a> 
   <div class="pB1_Body1">
 This section contains basic steps to configure crypto maps and includes the following tasks: </div>
<a href="https://www.blogger.com/null" name="wp1036938"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036953">Creating Crypto Map Entries</a> </div>
<a href="https://www.blogger.com/null" name="wp1036942"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037071">Verifying Crypto Map Entries</a> </div>
<a href="https://www.blogger.com/null" name="wp1036946"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037093">Applying Crypto Maps to Interfaces</a> </div>
<a href="https://www.blogger.com/null" name="wp1036950"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037138">Verifying Crypto Map Interface Associations</a> </div>
<a href="https://www.blogger.com/null" name="Creating_Crypto_Map_Entries"> </a> 
   <a href="https://www.blogger.com/null" name="wp1036953"></a> 
   <a href="https://www.blogger.com/null" name="wpxref41567"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1036952"></a> 
   <h3 class="p_H_Head3">
 Creating Crypto Map Entries </h3>
<a href="https://www.blogger.com/null" name="wp1036954"></a> 
   <div class="pB1_Body1">
 To create crypto map entries that will use IKE to establish the SAs, complete the following steps starting in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1037009"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1036959table1036955" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1036957"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036959"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1036961"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036963"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036966"></a><a href="https://www.blogger.com/null" name="wpmkr1036965"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">crypto map s4second 
local-address serial 2/0
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036968"></a><a href="https://www.blogger.com/null" name="wpmkr1036969"></a><div class="pB1_Body1">
 Create the crypto map and specify a local address (physical interface) to be used for the IPSec traffic. This example creates crypto map s4second and specifies serial interface 2/0 of the headquarters router as the local address. This step is only required if you have previously used the <span style="color: black; font-style: normal; font-weight: bold;">loopback</span> command or if you are using GRE tunnels. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036971"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036973"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">crypto map s4second 2 
ipsec-isakmp
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036975"></a><div class="pB1_Body1">
 Enter crypto map configuration mode, specify a sequence number for the crypto map you created in Step 1, and configure the crypto map to use IKE to establish SAs. This example configures sequence number 2 and IKE for crypto map s4second. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036977"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036980"></a><a href="https://www.blogger.com/null" name="wpmkr1036979"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-crypto-map)# </code><b class="cBold">match address 111
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036982"></a><div class="pB1_Body1">
 Specify an extended access list. This access list determines which traffic is protected by IPSec and which traffic is not be protected by IPSec. This example configures access list 111, which was created in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036823">"Creating Crypto Access Lists" section</a>. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036987"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036990"></a><a href="https://www.blogger.com/null" name="wpmkr1036989"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-crypto-map)# </code><b class="cBold">set peer 
172.23.2.7
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036992"></a><div class="pB1_Body1">
 Specify a remote IPSec peer (by host name or IP address). This is the peer to which IPSec protected traffic can be forwarded. This example specifies serial interface 1/0 (172.23.2.7) on the business partner router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1036994"></a><div class="pCSN_CellStepnext">
 Step 5  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036997"></a><a href="https://www.blogger.com/null" name="wpmkr1036996"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-crypto-map)# </code><b class="cBold">set transform-set 
proposal4
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1036999"></a><div class="pB1_Body1">
 Specify which transform sets are allowed for this crypto map entry. List multiple transform sets in order of priority (highest priority first). This example specifies transform set proposal4, which was configured in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036857">"Defining Transform Sets and Configuring IPSec Tunnel Mode" section</a>. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037004"></a><div class="pCSN_CellStepnext">
 Step 6  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037006"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-crypto-map)#</code><b class="cBold" style="font-weight: bold;"> exit 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config)#</span> 
</pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037008"></a><div class="pB1_Body1">
 Exit back to global configuration mode. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="wp1037011"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037010"></a> 
   <div class="pB1_Body1">
 To create dynamic crypto map entries that will use IKE to establish the SAs, complete the following steps, starting in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1037068"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1037016table1037012" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1037014"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037016"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037018"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037020"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037023"></a><a href="https://www.blogger.com/null" name="wpmkr1037022"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(config)# </code><span style="color: black; font-style: normal; font-weight: bold;">crypto dynamic-map</span> 
<span style="color: black; font-style: oblique; font-weight: normal;">dynamic-map-name dynamic-seq-num
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037025"></a><div class="pB1_Body1">
 Creates a dynamic crypto map entry. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037027"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037030"></a><a href="https://www.blogger.com/null" name="wpmkr1037029"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(config)# </code><span style="color: black; font-style: normal; font-weight: bold;">set transform-set</span> 
<span style="color: black; font-style: oblique; font-weight: normal;">transform-set-name1</span><span style="color: black; font-style: normal; font-weight: normal;"> 
[</span><span style="color: black; font-style: oblique; font-weight: normal;">transform-set-name2...transform-set-name6</span><span style="color: black; font-style: normal; font-weight: normal;">]
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037032"></a><div class="pB1_Body1">
 Specifies which transform sets are allowed for the crypto map entry. List multiple transform sets in order of priority (highest priority first). </div>
<a href="https://www.blogger.com/null" name="wp1037033"></a><div class="pB1_Body1">
 This is the only configuration statement required in dynamic crypto map entries. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037035"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037038"></a><a href="https://www.blogger.com/null" name="wpmkr1037037"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(config-crypto-map)# </code><span style="color: black; font-style: normal; font-weight: bold;">match address</span> 
<span style="color: black; font-style: oblique; font-weight: normal;">access-list-id
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037040"></a><div class="pB1_Body1">
 (Optional) Accesses list number or name of an extended access list. This access list determines which traffic should be protected by IPSec and which traffic should not be protected by IPSec security in the context of this crypto map entry. </div>
<a href="https://www.blogger.com/null" name="wp1037041"></a><div class="pNT_NoteTable">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />Although access-lists are optional for dynamic crypto maps, they are highly recommended. </div>
<a href="https://www.blogger.com/null" name="wp1037042"></a><div class="pB1_Body1">
 If the access list is configured, the data flow identity proposed by the IPSec peer must fall within a <b class="cBold">permit</b> statement for this crypto access list. </div>
<a href="https://www.blogger.com/null" name="wp1037043"></a><div class="pB1_Body1">
 If the access list is not configured, the router will accept any data flow identity proposed by the IPSec peer. However, if this is configured but the specified access list does not exist or is empty, the router will drop all packets. This is similar to static crypto maps because they also require that an access list be specified. </div>
<a href="https://www.blogger.com/null" name="wp1037044"></a><div class="pB1_Body1">
 Care must be taken if the <b class="cBold">any</b> keyword is used in the access list, because the access list is used for packet filtering as well as for negotiation. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037046"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037049"></a><a href="https://www.blogger.com/null" name="wpmkr1037048"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(config-crypto-map)# </code><span style="color: black; font-style: normal; font-weight: bold;">set peer</span> 
<span class="cCp_CmdPlain" style="font-style: normal;">{</span><span style="color: black; font-style: oblique; font-weight: normal;">hostname</span><span style="color: black; font-style: normal; font-weight: normal;"> | </span><span style="color: black; font-style: oblique; font-weight: normal;">ip-address</span><span style="color: black; font-style: normal; font-weight: normal;">}
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037051"></a><div class="pB1_Body1">
 (Optional) Specifies a remote IPSec peer. Repeat for multiple remote peers. </div>
<a href="https://www.blogger.com/null" name="wp1037052"></a><div class="pB1_Body1">
 This is rarely configured in dynamic crypto map entries. Dynamic crypto map entries are often used for unknown remote peers. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037054"></a><div class="pCSN_CellStepnext">
 Step 5  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037056"></a><a href="https://www.blogger.com/null" name="wpmkr1037057"></a> 
        <div class="pCellExample">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(config-crypto-map)# </code><span style="color: black; font-style: normal; font-weight: bold;">set 
security-association lifetime seconds</span> <span style="color: black; font-style: oblique; font-weight: normal;">seconds
</span></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037058"></a> 
        <div class="pCellExample">
 
         <pre>and/or
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037059"></a> 
        <div class="pEx1_Example1">
 
         <pre><span style="color: black; font-style: normal; font-weight: bold;">set security-association lifetime kilobytes</span> 
<span style="color: black; font-style: oblique; font-weight: normal;">kilobytes
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037061"></a><div class="pB1_Body1">
 (Optional) If you want the security associations for this crypto map to be negotiated using shorter IPSec security association lifetimes than the globally specified lifetimes, specify a key lifetime for the crypto map entry. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037063"></a><div class="pCSN_CellStepnext">
 Step 6  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037065"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-crypto-map)#</code><b class="cBold" style="font-weight: bold;"> exit 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config)#</span> 
</pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037067"></a><div class="pB1_Body1">
 Exit back to global configuration mode. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Verifying_Crypto_Map_Entries"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037071"></a> 
   <a href="https://www.blogger.com/null" name="wpxref42286"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037070"></a> 
   <h3 class="p_H_Head3">
 Verifying Crypto Map Entries </h3>
<a href="https://www.blogger.com/null" name="wp1037072"></a> 
   <div class="pB1_Body1">
 To verify the configuration: </div>
<a href="https://www.blogger.com/null" name="wp1037074"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037073"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the <b class="cBold">show crypto map </b>EXEC command to see the crypto map entries configured on the router. </div>
<a href="https://www.blogger.com/null" name="wp1037075"></a> 
   <div class="pB2_Body2">
 In the following example, peer 172.23.2.7 is the IP address of the remote IPSec peer. "Extended IP access list 111" lists the access list associated with the crypto map. "Current peer" indicates the current IPSec peer. "Security-association lifetime" indicates the lifetime of the SA. </div>
<a href="https://www.blogger.com/null" name="wp1037076"></a> 
   <div class="pB2_Body2">
 "PFS N" indicates that IPSec will not negotiate perfect forward secrecy when establishing new SAs for this crypto map. "Transform sets" indicates the name of the transform set that can be used with the crypto map. </div>
<a href="https://www.blogger.com/null" name="wp1037077"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show crypto map
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037078"></a> 
   <div class="pEx1_Example1">
 
    <pre>Crypto Map: "s4second" idb: Serial2/0 local address: 172.16.2.2
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037079"></a> 
   <div class="pEx1_Example1">
 
    <pre>Crypto Map "s4second" 2 ipsec-isakmp
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037080"></a> 
   <div class="pEx1_Example1">
 
    <pre>        Peer = 172.23.2.7
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037081"></a> 
   <div class="pEx1_Example1">
 
    <pre>        Extended IP access list 111
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037082"></a> 
   <div class="pEx1_Example1">
 
    <pre>            access-list 111 permit ip 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037083"></a> 
   <div class="pEx1_Example1">
 
    <pre>                source: addr = 10.2.2.2/255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037084"></a> 
   <div class="pEx1_Example1">
 
    <pre>                dest:   addr = 10.1.5.3/255.255.255.0S
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037085"></a> 
   <div class="pEx1_Example1">
 
    <pre>        Current peer: 172.23.2.7
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037086"></a> 
   <div class="pEx1_Example1">
 
    <pre>        Security-association lifetime: 4608000 kilobytes/3600 seconds
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037087"></a> 
   <div class="pEx1_Example1">
 
    <pre>        PFS (Y/N): N
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037088"></a> 
   <div class="pEx1_Example1">
 
    <pre>        Transform sets={proposal4,}
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1037089"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037090"></a> 
   <div class="pEx1_Example1">
 
    <pre>  -Display text omitted-
</pre>
</div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/tip.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037091"></a> 
   <div class="pTip">
 <b>Tip </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="8" />If you have trouble, make sure you are using the correct IP addresses. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Applying_Crypto_Maps_to_Interfaces"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037093"></a> 
   <a href="https://www.blogger.com/null" name="wpxref33637"></a> 
   <h3 class="p_H_Head3">
 Applying Crypto Maps to Interfaces </h3>
<a href="https://www.blogger.com/null" name="wp1037095"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037094"></a> 
   <div class="pB1_Body1">
 You need to apply a crypto map set to each interface through which IPSec traffic will flow. Applying the crypto map set to an interface instructs the router to evaluate all the interface traffic against the crypto map set, and to use the specified policy during connection or SA negotiation on behalf of traffic to be protected by crypto. </div>
<a href="https://www.blogger.com/null" name="wp1037096"></a> 
   <div class="pB1_Body1">
 To apply a crypto map set to an interface, complete the following steps starting in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1037135"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1037101table1037097" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1037099"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037101"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037103"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037105"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037107"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">interface serial 2/0
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037109"></a><div class="pB1_Body1">
 Specify a physical interface on which to apply the crypto map and enter interface configuration mode. This example specifies serial interface 2/0 on the headquarters router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037111"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037114"></a><a href="https://www.blogger.com/null" name="wpmkr1037113"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold">crypto map s4second
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037116"></a><div class="pB1_Body1">
 Apply the crypto map set to the physical interface. This example configures crypto map s4second, which was created in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036953">"Creating Crypto Map Entries" section</a>. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037121"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037123"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold" style="font-weight: bold;">exit 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config)#
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037125"></a><div class="pB1_Body1">
 Exit back to global configuration mode. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037127"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037130"></a><a href="https://www.blogger.com/null" name="wpmkr1037129"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose# </code><b class="cBold">clear crypto sa
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037133"></a><a href="https://www.blogger.com/null" name="wpmkr1037132"></a><div class="pB1_Body1">
 In privileged EXEC mode, clear the existing IPSec SAs so that any changes are used immediately. (Manually established SAs are reestablished immediately.) </div>
<a href="https://www.blogger.com/null" name="wp1037134"></a><div class="pNT_NoteTable">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />Using the <b class="cBold">clear crypto sa</b> command without parameters clears out the full SA database, which clears out active security sessions. You may also specify the <b class="cBold">peer</b>, <b class="cBold">map</b>, or <b class="cBold">entry</b> keywords to clear out only a subset of the SA database. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Verifying_Crypto_Map_Interface_Associations"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037138"></a> 
   <a href="https://www.blogger.com/null" name="wpxref15321"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037137"></a> 
   <h3 class="p_H_Head3">
 Verifying Crypto Map Interface Associations </h3>
<a href="https://www.blogger.com/null" name="wp1037139"></a> 
   <div class="pB1_Body1">
 To verify the configuration: </div>
<a href="https://www.blogger.com/null" name="wp1037141"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037140"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the<b class="cBold"> show crypto map interface serial 2/0 </b>EXEC command to see the crypto maps applied to a specific interface. </div>
<a href="https://www.blogger.com/null" name="wp1037142"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show crypto map interface serial 2/0
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037143"></a> 
   <div class="pEx1_Example1">
 
    <pre><code class="cExPlain">Crypto Map "s4second" 2 ipsec-isakmp
</code></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037144"></a> 
   <div class="pEx1_Example1">
 
    <pre><code class="cExPlain">        Peer = 172.23.2.7
</code></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037145"></a> 
   <div class="pEx1_Example1">
 
    <pre><code class="cExPlain">        Extended IP access list 111
</code></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037146"></a> 
   <div class="pEx1_Example1">
 
    <pre><code class="cExPlain">            access-list 111 permit ip host 10.2.2.2 host 10.1.5.3
</code></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037147"></a> 
   <div class="pEx1_Example1">
 
    <pre><code class="cExPlain">        Current peer:172.23.2.7
</code></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037148"></a> 
   <div class="pEx1_Example1">
 
    <pre><code class="cExPlain">        Security association lifetime:4608000 kilobytes/1000 seconds
</code></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037149"></a> 
   <div class="pEx1_Example1">
 
    <pre><code class="cExPlain">        PFS (Y/N):N
</code></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037150"></a> 
   <div class="pEx1_Example1">
 
    <pre><code class="cExPlain">        Transform sets={ proposal4, }
</code></pre>
</div>
<a href="https://www.blogger.com/null" name="Step_4-Configuring_Quality_of_Service"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037153"></a> 
   <a href="https://www.blogger.com/null" name="wpxref40376"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037152"></a> 
   <h2 class="p_H_Head1">
 Step 4—Configuring Quality of Service </h2>
<a href="https://www.blogger.com/null" name="wp1037154"></a> 
   <div class="pB1_Body1">
 Cisco IOS quality of service (QoS) refers to the ability of a network to provide better service to selected network traffic over various underlying technologies including Frame Relay, Asynchronous Transfer Mode (ATM), Ethernet and 802.1 networks, SONET, and IP-routed networks. In particular, QoS features provide better and more predictable network service by: </div>
<a href="https://www.blogger.com/null" name="wp1037156"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037155"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Supporting dedicated bandwidth </div>
<a href="https://www.blogger.com/null" name="wp1037157"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Improving loss characteristics </div>
<a href="https://www.blogger.com/null" name="wp1037158"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Avoiding and managing network congestion </div>
<a href="https://www.blogger.com/null" name="wp1037159"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Shaping network traffic </div>
<a href="https://www.blogger.com/null" name="wp1037160"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Setting traffic priorities across the network </div>
<a href="https://www.blogger.com/null" name="wp1037161"></a> 
   <div class="pB1_Body1">
 You configure QoS features throughout a network to provide for end-to-end QoS delivery. The following three components are necessary to deliver QoS across a heterogeneous network: </div>
<a href="https://www.blogger.com/null" name="wp1037162"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />QoS within a single network element, which includes queuing, scheduling, and traffic shaping features. </div>
<a href="https://www.blogger.com/null" name="wp1037163"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />QoS signaling techniques for coordinating QoS from end-to-end between network elements. </div>
<a href="https://www.blogger.com/null" name="wp1037164"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />QoS policing and management functions to control and administer end-to-end traffic across a network. </div>
<a href="https://www.blogger.com/null" name="wp1037165"></a> 
   <div class="pB1_Body1">
 Not all QoS techniques are appropriate for all network routers. Because edge routers and backbone routers in a network do not necessarily perform the same operations, the QoS tasks they perform might differ as well. </div>
<a href="https://www.blogger.com/null" name="wp1037167"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037166"></a> 
   <div class="pB1_Body1">
 In general, edge routers perform the following QoS functions: </div>
<a href="https://www.blogger.com/null" name="wp1037168"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Packet classification and prioritization </div>
<a href="https://www.blogger.com/null" name="wp1037169"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Admission control, such as queuing and policing </div>
<a href="https://www.blogger.com/null" name="wp1037170"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Bandwidth management </div>
<a href="https://www.blogger.com/null" name="wp1037171"></a> 
   <div class="pB1_Body1">
 In general, backbone routers perform the following QoS functions: </div>
<a href="https://www.blogger.com/null" name="wp1037173"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037172"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Congestion management </div>
<a href="https://www.blogger.com/null" name="wp1037174"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Congestion avoidance </div>
<a href="https://www.blogger.com/null" name="wp1037176"></a> 
   <div class="pB1_Body1">
 Cisco IOS QoS service models, features, and sample configurations are explained in detail in the <span style="color: black; font-style: italic; font-weight: normal;">Quality of Service Solutions Configuration Guide</span> and the <span style="color: black; font-style: italic; font-weight: normal;">Quality of Service Solutions Command Reference</span>. Refer to these two publications as you plan and implement a QoS strategy for your VPN, because there are various QoS service models and features that you can implement on your VPN. See <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342prf.html#wpxref74569"><span class="cXRef_Color" style="font-weight: normal;">"Related Documentation" section on page xi</span></a> for information on how to access these publications. </div>
<a href="https://www.blogger.com/null" name="wp1037179"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037178"></a> 
   <div class="pB1_Body1">
 This section contains basic steps to configure QoS weighted fair queuing (WFQ), which applies priority (or weights) to identified traffic on the GRE tunnel you configured in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036058">"Step 1—Configuring the Tunnel" section</a>. This section also contains basic steps to configure Network-Based Application Recognition (NBAR), which is a classification engine that recognizes a wide variety of applications, including web-based and other protocols that utilize dynamic TCP/UDP port assignments. </div>
<a href="https://www.blogger.com/null" name="wp1037183"></a> 
   <div class="pB1_Body1">
 This section includes the following topics: </div>
<a href="https://www.blogger.com/null" name="wp1037187"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037207">Configuring Network-Based Application Recognition</a> </div>
<a href="https://www.blogger.com/null" name="wp1037191"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1043858">Configuring Weighted Fair Queuing</a> </div>
<a href="https://www.blogger.com/null" name="wp1037195"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037473">Verifying Weighted Fair Queuing</a> </div>
<a href="https://www.blogger.com/null" name="wp1037199"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037499">Configuring Class-Based Weighted Fair Queuing</a> </div>
<a href="https://www.blogger.com/null" name="wp1037203"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037642">Verifying Class-Based Weighted Fair Queuing</a> </div>
<a href="https://www.blogger.com/null" name="Configuring_Network-Based_Application_Recognition"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037207"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037204"></a> 
   <a href="https://www.blogger.com/null" name="wpxref13996"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037206"></a> 
   <h3 class="p_H_Head2">
 Configuring Network-Based Application Recognition </h3>
<a href="https://www.blogger.com/null" name="wp1037208"></a> 
   <div class="pB1_Body1">
 Network-Based Application Recognition (NBAR) adds intelligent network classification to network infrastructures. NBAR is a classification engine that recognizes a wide variety of applications, including web-based and other protocols that utilize dynamic TCP/UDP port assignments. When an application is recognized and classified by NBAR, a network can invoke services for that specific application. NBAR ensures that network bandwidth is used efficiently by working with QoS features. </div>
<a href="https://www.blogger.com/null" name="wp1037211"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037209"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037210"></a> 
   <div class="pB1_Body1">
 Your interface to NBAR is through the modular QoS command-line interface (MQC). MQC provides a model for QoS configuration under IOS. MQC provides a clean separation between the specification of a classification policy and the specification of other policies that act based on the results of the applied classification. </div>
<a href="https://www.blogger.com/null" name="wp1037212"></a> 
   <div class="pB1_Body1">
 Configuring a QoS policy typically requires the configuration of traffic classes, the configuration of policies that will be applied to those traffic classes, and the attaching of policies to interfaces using the commands in the sections that follow. </div>
<a href="https://www.blogger.com/null" name="wp1037213"></a> 
   <div class="pB1_Body1">
 The following tasks are required to configure NBAR: </div>
<a href="https://www.blogger.com/null" name="wp1037217"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037238">Configuring a Class Map</a> </div>
<a href="https://www.blogger.com/null" name="wp1037221"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037282">Verifying a Class Map Configuration</a> </div>
<a href="https://www.blogger.com/null" name="wp1037225"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037289">Configuring a Policy Map</a> </div>
<a href="https://www.blogger.com/null" name="wp1037229"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037364">Attaching a Policy Map to an Interface</a> </div>
<a href="https://www.blogger.com/null" name="wp1037233"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037393">Verifying a Policy Map Configuration</a> </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037234"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />You must enable Cisco Express Forwarding (CEF) before you configure NBAR. For more information on CEF, refer to the Cisco IOS Release 12.0 configuration guide titled <span style="color: black; font-style: italic; font-weight: normal;">Cisco IOS Switching Services Configuration Guide</span>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Configuring_a_Class_Map"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037238"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037235"></a> 
   <a href="https://www.blogger.com/null" name="wpxref13038"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037237"></a> 
   <h3 class="p_H_Head3">
 Configuring a Class Map </h3>
<a href="https://www.blogger.com/null" name="wp1037240"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037239"></a> 
   <div class="pB1_Body1">
 Use the <b class="cBold">class-map</b> configuration command to define a traffic class and the match criteria that will be used to identify traffic as belonging to that class. Match statements can include criteria such as protocol, ACL, IP precedence value, or interface identifier. The match criteria is defined with one or more of the match statements entered within the class-map configuration mode listed in the table below: </div>
<a href="https://www.blogger.com/null" name="wp1037279"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1037245table1037241" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1037243"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037245"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037247"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037249"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037252"></a><a href="https://www.blogger.com/null" name="wpmkr1037251"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config)# <b class="cBold">class-map match-all</b> | <b class="cBold" style="font-style: normal;">match-any 
</b><span style="color: black; font-style: oblique; font-weight: normal;">class-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037254"></a><div class="pB1_Body1">
 Specifies the user-defined name of the class map. The <b class="cBold">match-all</b> option specifies that all match criteria in the class map must be matched. The <b class="cBold">match-any</b> option specifies that one or more match criteria must match.<sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037261">1</a> </sup> </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037266"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037269"></a><a href="https://www.blogger.com/null" name="wpmkr1037268"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config-cmap)# <b class="cBold">match protocol</b><em class="cCi_CmdItalic" style="font-style: italic;"> </em><span style="color: black; font-style: oblique; font-weight: normal;">protocol-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037271"></a><div class="pB1_Body1">
 Specifies a protocol supported by NBAR as a matching criteria. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037273"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037276"></a><a href="https://www.blogger.com/null" name="wpmkr1037275"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config-cmap)# <span style="color: black; font-style: normal; font-weight: bold;">match class-map </span><span style="color: black; font-style: oblique; font-weight: normal;">class-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037278"></a><div class="pB1_Body1">
 Specifies a class map as a matching criteria (nested class maps). </div>
</td> 
      </tr>
</tbody> 
    </table>
<table> 
     <tbody>
<tr> 
       <td><a href="https://www.blogger.com/null" name="wp1037261"></a><a href="https://www.blogger.com/null" name="wpmkr1037257"></a><a href="https://www.blogger.com/null" name="wpmkr1037258"></a><a href="https://www.blogger.com/null" name="wpmkr1037259"></a><a href="https://www.blogger.com/null" name="wpmkr1037260"></a><a href="https://www.blogger.com/null" name="wpmkr1037262"></a><a href="https://www.blogger.com/null" name="wpmkr1037263"></a><a href="https://www.blogger.com/null" name="wpmkr1037264"></a><div class="pTFi_TableFootnoteIndent">
 <sup><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037254">1</a> </sup>When neither <b class="cBold">match-all</b> nor<b class="cBold"> match-any</b> is specified, the default is <b class="cBold">match-all</b>. Use the <b class="cBold">no class-map</b> command to disable the class map. Use the <b class="cBold">no match-all</b> and <b class="cBold">no match-any</b> commands to disable these commands within the class map. Use the <b class="cBold">match not</b> command to configure a match that evaluates to true if the packet does not match the specified protocol. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Verifying_a_Class_Map_Configuration"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037282"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037280"></a> 
   <a href="https://www.blogger.com/null" name="wpxref76320"></a> 
   <h3 class="p_H_Head3">
 Verifying a Class Map Configuration </h3>
<a href="https://www.blogger.com/null" name="wp1037284"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037283"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037285"></a> 
   <div class="pB1_Body1">
 Enter the <span style="color: black; font-style: normal; font-weight: bold;">show class-map</span> command to display all class map information. You can also enter the <span style="color: black; font-style: normal; font-weight: bold;">show class-map</span><em class="cCi_CmdItalic"> class-name </em>command to display the class map information of a user-specified class map. </div>
<a href="https://www.blogger.com/null" name="Configuring_a_Policy_Map"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037289"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037286"></a> 
   <a href="https://www.blogger.com/null" name="wpxref95555"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037288"></a> 
   <h3 class="p_H_Head3">
 Configuring a Policy Map </h3>
<a href="https://www.blogger.com/null" name="wp1037290"></a> 
   <div class="pB1_Body1">
 Use the <b class="cBold">policy-map configuration </b>command to specify the QoS policies to apply to traffic classes defined by a class map. QoS policies that can be applied to traffic classification are listed in the table below. </div>
<a href="https://www.blogger.com/null" name="wp1037354"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1037295table1037291" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1037293"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037295"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037297"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037299"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037302"></a><a href="https://www.blogger.com/null" name="wpmkr1037301"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config)# <b class="cBold" style="font-weight: bold;">policy-map</b><span style="color: black; font-style: normal; font-weight: bold;"> </span><em class="cCi_CmdItalic">policy-name
</em></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037304"></a><div class="pB1_Body1">
 User specified policy map name. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037306"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037309"></a><a href="https://www.blogger.com/null" name="wpmkr1037308"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config-pmap)# <b class="cBold" style="font-style: normal;">class </b><span style="color: black; font-style: oblique; font-weight: normal;">class-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037311"></a><div class="pB1_Body1">
 Specifies the name of a previously defined class map. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037313"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037316"></a><a href="https://www.blogger.com/null" name="wpmkr1037315"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config-pmap-c)# <b class="cBold" style="font-style: normal;">bandwidth </b><span style="color: black; font-style: oblique; font-weight: normal;">kbps
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037318"></a><div class="pB1_Body1">
 Specifies a minimum bandwidth guarantee to a traffic class. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037320"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037323"></a><a href="https://www.blogger.com/null" name="wpmkr1037322"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config-pmap-c)#<b class="cBold" style="font-style: normal;"> police </b><span style="color: black; font-style: oblique; font-weight: normal;">bps</span><em class="cCi_CmdItalic" style="font-style: italic;"> </em><span style="color: black; font-style: normal; font-weight: bold;">conform 
transmit exceed drop
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037325"></a><div class="pB1_Body1">
 Specifies a maximum bandwidth usage by a traffic class. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037327"></a><div class="pCSN_CellStepnext">
 Step 5  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037330"></a><a href="https://www.blogger.com/null" name="wpmkr1037329"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config-pmap-c)# <b class="cBold">set ip precedence {0-7}
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037332"></a><div class="pB1_Body1">
 Specifies the IP precedence of packets within a traffic class. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037334"></a><div class="pCSN_CellStepnext">
 Step 6  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037337"></a><a href="https://www.blogger.com/null" name="wpmkr1037336"></a> 
        <div class="pEx1_Example1">
 
         <pre>outer(config-pmap-c)# <b class="cBold">set qos-group {0-99}
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037339"></a><div class="pB1_Body1">
 Specifies a QoS-group value to associate with the packet. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037341"></a><div class="pCSN_CellStepnext">
 Step 7  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037344"></a><a href="https://www.blogger.com/null" name="wpmkr1037343"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config-pmap-c)# <b class="cBold">random-detect
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037346"></a><div class="pB1_Body1">
 Enables weighted random early detection (WRED) drop policy for a traffic class which has a bandwidth guarantee. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037348"></a><div class="pCSN_CellStepnext">
 Step 8  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037351"></a><a href="https://www.blogger.com/null" name="wpmkr1037350"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config-pmap-c)# <b class="cBold" style="font-style: normal;">queue-limit </b><span style="color: black; font-style: oblique; font-weight: normal;">packets
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037353"></a><div class="pB1_Body1">
 Specifies maximum number of packets queued for a traffic class (in the absence of random-detect). </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="wp1037358"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037355"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037356"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037357"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037359"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037360"></a> 
   <div class="pB1_Body1">
 Use the <b class="cBold">no policy-map</b> command to deconfigure the policy map. Use the <b class="cBold">no bandwidth</b>, <b class="cBold">no police</b>, <b class="cBold">no set,</b> and <b class="cBold">no random-detect</b> commands to disable these commands within the policy map. </div>
<a href="https://www.blogger.com/null" name="Attaching_a_Policy_Map_to_an_Interface"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037364"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037361"></a> 
   <a href="https://www.blogger.com/null" name="wpxref27289"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037363"></a> 
   <h3 class="p_H_Head3">
 Attaching a Policy Map to an Interface </h3>
<a href="https://www.blogger.com/null" name="wp1037365"></a> 
   <div class="pB1_Body1">
 Use the <span style="color: black; font-style: normal; font-weight: bold;">service-policy</span> interface configuration command to attach a policy map to an interface and to specify the direction in which the policy should be applied (on either packets coming into the interface or packets leaving the interface). </div>
<a href="https://www.blogger.com/null" name="wp1037387"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1037370table1037366" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1037368"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037370"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037372"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037374"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037377"></a><a href="https://www.blogger.com/null" name="wpmkr1037376"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config-if)# <b class="cBold" style="font-weight: bold;">service-policy output</b><span style="color: black; font-style: normal; font-weight: bold;"> 
</span><span style="color: black; font-style: oblique; font-weight: normal;">policy-map-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037379"></a><div class="pB1_Body1">
 Specifies the name of the policy map to be attached to the output direction of the interface. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037381"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037384"></a><a href="https://www.blogger.com/null" name="wpmkr1037383"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router(config-if)# <b class="cBold" style="font-weight: bold;">service-policy input</b><span style="color: black; font-style: normal; font-weight: bold;"> 
</span><span style="color: black; font-style: oblique; font-weight: normal;">policy-map-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037386"></a><div class="pB1_Body1">
 Specifies the name of the policy map to be attached to the input direction of the interface. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="wp1037389"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037388"></a> 
   <div class="pB1_Body1">
 Use the <b class="cBold" style="font-weight: bold;">no service-policy</b><span style="color: black; font-style: normal; font-weight: bold;"> </span>[<em class="cCi_CmdItalic" style="font-style: italic;">input</em><span style="color: black; font-style: italic; font-weight: normal;"> </span>| <em class="cCi_CmdItalic">output</em>] <em class="cCi_CmdItalic" style="font-style: italic;">policy-map-name</em><span style="color: black; font-style: italic; font-weight: normal;"> </span>command to detach a policy map from an interface. </div>
<a href="https://www.blogger.com/null" name="Verifying_a_Policy_Map_Configuration"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037393"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037390"></a> 
   <a href="https://www.blogger.com/null" name="wpxref70886"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037392"></a> 
   <h3 class="p_H_Head3">
 Verifying a Policy Map Configuration </h3>
<a href="https://www.blogger.com/null" name="wp1043818"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1043885"></a> 
   <div class="pB1_Body1">
 Use the <span style="color: black; font-style: normal; font-weight: bold;">s</span><b class="cBold">how policy-map</b> [<b class="cBold">interface </b>[<em class="cCi_CmdItalic">interface-spec </em>[<em class="cCi_CmdItalic" style="font-style: italic;">input</em><span style="color: black; font-style: italic; font-weight: normal;"> | </span><em class="cCi_CmdItalic">output </em>[<b class="cBold" style="font-style: normal;">class</b><span style="color: black; font-style: italic; font-weight: normal;"> </span><em class="cCi_CmdItalic">class-name</em>]]]]<span style="color: black; font-style: italic; font-weight: normal;"> </span>command to display the configuration of a policy map and its associated class maps. Forms of this command are listed in the following table: </div>
<a href="https://www.blogger.com/null" name="wp1043869"></a> 
   <div class="pTableAnchor">
 <span style="color: black; font-style: normal; font-weight: normal;"></span></div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" id="wp1043899table1043897" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1043899"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1043901"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1043903"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router# <b class="cBold" style="font-weight: bold;">show policy-ma</b><span style="color: black; font-style: normal; font-weight: bold;">p
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1043905"></a><div class="pB1_Body1">
 Displays all configured policy maps. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1043907"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router# <b class="cBold" style="font-weight: bold;">show policy-ma</b><span style="color: black; font-style: normal; font-weight: bold;">p </span><span style="color: black; font-style: oblique; font-weight: normal;">policy-map-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1043909"></a><div class="pB1_Body1">
 Displays the user-specified policy map. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1043911"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router# <b class="cBold">show policy-map interface
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1043913"></a><div class="pB1_Body1">
 Displays statistics and configurations of all input and output policies, which are attached to an interface. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1043915"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router# <b class="cBold" style="font-weight: bold;">show policy-map</b><span style="color: black; font-style: normal; font-weight: bold;"> </span><span style="color: black; font-style: oblique; font-weight: normal;">interface-spec
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1043917"></a><div class="pB1_Body1">
 Displays configuration and statistics of the input and output policies attached to a particular interface. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1043919"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router#<b class="cBold" style="font-style: normal;"> show policy-map </b><span style="color: black; font-style: oblique; font-weight: normal;">interface-spec[input]
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1043921"></a><div class="pB1_Body1">
 Displays configuration and statistics of the input policy attached to an interface<span style="color: black; font-style: italic; font-weight: normal;">.</span> </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1043923"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router# <b class="cBold" style="font-weight: bold;">show policy-map</b><span style="color: black; font-style: normal; font-weight: bold;"> </span><span style="color: black; font-style: oblique; font-weight: normal;">interface-spec[output]
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1043925"></a><div class="pB1_Body1">
 Displays configuration statistics of the output policy attached to an interface. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1043927"></a> 
        <div class="pEx1_Example1">
 
         <pre>Router# <b class="cBold" style="font-weight: bold;">show policy-map</b><span style="color: black; font-style: normal; font-weight: bold;"> </span><b class="cBold" style="font-style: normal;">interface-spec</b><span style="color: black; font-style: oblique; font-weight: normal;">[input|output] 
</span><span style="color: black; font-style: normal; font-weight: bold;">class</span><span style="color: black; font-style: oblique; font-weight: normal;"> class-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1043929"></a><a href="https://www.blogger.com/null" name="wpmkr1043930"></a><div class="pB1_Body1">
 Displays the configuration and statistics for the class name configured in the policy. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<br /> 
   <div class="pTableAnchor">
 <span style="color: black; font-style: normal; font-weight: normal;"></span> </div>
<a href="https://www.blogger.com/null" name="Configuring_Weighted_Fair_Queuing"> </a> 
   <a href="https://www.blogger.com/null" name="wp1043858"></a> 
   <a href="https://www.blogger.com/null" name="wpxref29177"></a> 
   <h3 class="p_H_Head2">
 Configuring Weighted Fair Queuing </h3>
<a href="https://www.blogger.com/null" name="wp1037437"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037436"></a> 
   <div class="pB1_Body1">
 Weighted Fair Queuing (WFQ) provides traffic priority management that automatically sorts among individual traffic streams without requiring that you first define access lists. WFQ can also manage duplex data streams such as those between pairs of applications, and simplex data streams such as voice or video. There are two categories of WFQ sessions: high bandwidth and low bandwidth. Low-bandwidth traffic has effective priority over high-bandwidth traffic, and high-bandwidth traffic shares the transmission service proportionally according to assigned weights. </div>
<a href="https://www.blogger.com/null" name="wp1037438"></a> 
   <div class="pB1_Body1">
 When WFQ is enabled for an interface, new messages for high-bandwidth traffic streams are discarded after the configured or default congestive messages threshold has been met. However, low-bandwidth conversations, which include control message conversations, continue to enqueue data. As a result, the fair queue may occasionally contain more messages than its configured threshold number specifies. </div>
<a href="https://www.blogger.com/null" name="wp1037440"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037439"></a> 
   <div class="pB1_Body1">
 With standard WFQ, packets are classified by flow. Packets with the same source IP address, destination IP address, source Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port, or destination TCP or UDP port belong to the same flow. WFQ allocates an equal share of the bandwidth to each flow. Flow-based WFQ is also called fair queuing because all flows are equally weighted. </div>
<a href="https://www.blogger.com/null" name="wp1037442"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037441"></a> 
   <div class="pB1_Body1">
 To configure fair queuing on an interface, complete the following steps starting in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1037470"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1037447table1037443" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1037445"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037447"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037449"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037451"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037454"></a><a href="https://www.blogger.com/null" name="wpmkr1037453"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">interface serial 1/0
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037456"></a><div class="pB1_Body1">
 Specify an interface and enter interface configuration mode. This example specifies serial interface 1/0 on the headquarters router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037458"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037461"></a><a href="https://www.blogger.com/null" name="wpmkr1037460"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold">fair-queue
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037463"></a><div class="pB1_Body1">
 <span class="cCp_CmdPlain">Configure fair queuing on the interface.</span> </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037465"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037467"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold" style="font-weight: bold;">exit 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config)#
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037469"></a><div class="pB1_Body1">
 Exit back to global configuration mode. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Verifying_Weighted_Fair_Queuing"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037473"></a> 
   <a href="https://www.blogger.com/null" name="wpxref35550"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037472"></a> 
   <h3 class="p_H_Head2">
 Verifying Weighted Fair Queuing </h3>
<a href="https://www.blogger.com/null" name="wp1037474"></a> 
   <div class="pB1_Body1">
 To verify the configuration: </div>
<a href="https://www.blogger.com/null" name="wp1037476"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037475"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the<b class="cBold"> show interfaces serial 1/0 fair-queue</b> EXEC command to see information on the interface that is configured for WFQ. </div>
<a href="https://www.blogger.com/null" name="wp1037477"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show interfaces serial 1/0 fair-queue
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037478"></a> 
   <div class="pEx1_Example1">
 
    <pre>Serial1/0 queue size 0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037479"></a> 
   <div class="pEx1_Example1">
 
    <pre>     packets output 35, drops 0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037480"></a> 
   <div class="pEx1_Example1">
 
    <pre>WFQ: global queue limit 401, local queue limit 200
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1037481"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037483"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037482"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the<b class="cBold"> show interfaces serial 1/0 </b>EXEC command to verify the queuing for the interface is WFQ. </div>
<a href="https://www.blogger.com/null" name="wp1037484"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show interfaces serial 1/0
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037485"></a> 
   <div class="pEx1_Example1">
 
    <pre>Serial1/0 is up, line protocol is up 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037486"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Hardware is M2T-T3 pa
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1037487"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037488"></a> 
   <div class="pEx1_Example1">
 
    <pre>  -Display text omitted-
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1037489"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037490"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Queueing strategy:weighted fair
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037491"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Output queue:0/1000/64/0 (size/max total/threshold/drops) 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037492"></a> 
   <div class="pEx1_Example1">
 
    <pre>     Conversations  0/0/256 (active/max active/max total)
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037493"></a> 
   <div class="pEx1_Example1">
 
    <pre>     Reserved Conversations 0/0 (allocated/max allocated)
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1037494"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037495"></a> 
   <div class="pEx1_Example1">
 
    <pre>  -Display text omitted-
</pre>
</div>
<a href="https://www.blogger.com/null" name="Configuring_Class-Based_Weighted_Fair_Queuing"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037499"></a> 
   <a href="https://www.blogger.com/null" name="wpxref96636"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037497"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037498"></a> 
   <h3 class="p_H_Head2">
 Configuring Class-Based Weighted Fair Queuing </h3>
<a href="https://www.blogger.com/null" name="wp1037501"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037500"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037502"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037503"></a> 
   <div class="pB1_Body1">
 Class-based weighted fair queueing (CBWFQ) extends the standard WFQ functionality to provide support for user-defined traffic classes. For CBWFQ, you define traffic classes based on match criteria including protocols, access control lists (ACLs), and input interfaces. Packets satisfying the match criteria for a class constitute the traffic for that class. A queue is reserved for each class, and traffic belonging to a class is directed to that class queue. </div>
<a href="https://www.blogger.com/null" name="wp1037504"></a> 
   <div class="pB1_Body1">
 Once a class has been defined according to its match criteria, you can assign it characteristics. To characterize a class, you assign it bandwidth, weight, and maximum packet limit. The bandwidth assigned to a class is the minimum bandwidth delivered to the class during congestion. </div>
<a href="https://www.blogger.com/null" name="wp1037505"></a> 
   <div class="pB1_Body1">
 To characterize a class, you also specify the queue limit for that class, which is the maximum number of packets allowed to accumulate in the class queue. Packets belonging to a class are subject to the bandwidth and queue limits that characterize the class. </div>
<a href="https://www.blogger.com/null" name="wp1037506"></a> 
   <div class="pB1_Body1">
 After a queue has reached its configured queue limit, enqueuing of additional packets to the class causes tail drop or packet drop to take effect, depending on how class policy is configured. </div>
<a href="https://www.blogger.com/null" name="wp1037508"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037507"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037509"></a> 
   <div class="pB1_Body1">
 Tail drop is used for CBWFQ classes unless you explicitly configure policy for a class to use weighted random early detection (WRED) to drop packets as a means of avoiding congestion. Note that if you use WRED packet drop instead of tail drop for one or more classes comprising a policy map, you must ensure that WRED is not configured for the interface to which you attach that service policy. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037510"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />Although CBWFQ supports the use of WRED, this guide does not include WRED configuration procedures. For more information on using WRED with CBWFQ, refer to the <span class="cXRef_Color" style="font-style: normal; font-weight: normal;">Cisco IOS Release 12.2</span><span class="cXRef_Color" style="font-style: italic; font-weight: normal;"> </span><span class="cXRef_Color" style="font-style: normal; font-weight: normal;">Configuration Guide Master Index</span>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037511"></a> 
   <div class="pB1_Body1">
 If a default class is configured, all unclassified traffic is treated as belonging to the default class. If no default class is configured, then by default the traffic that does not match any of the configured classes is flow classified and given best-effort treatment. Once a packet is classified, all of the standard mechanisms that can be used to differentiate service among the classes apply. </div>
<a href="https://www.blogger.com/null" name="wp1037512"></a> 
   <div class="pB1_Body1">
 Flow classification is standard WFQ treatment. That is, packets with the same source IP address, destination IP address, source Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port, or destination TCP or UDP port are classified as belonging to the same flow. WFQ allocates an equal share of bandwidth to each flow. Flow-based WFQ is also called fair queueing because all flows are equally weighted. </div>
<a href="https://www.blogger.com/null" name="wp1037513"></a> 
   <div class="pB1_Body1">
 For CBWFQ, which extends the standard WFQ, the weight specified for the class becomes the weight of each packet that meets the match criteria of the class. Packets that arrive at the output interface are classified according to the match criteria filters you define, then each one is assigned the appropriate weight. </div>
<a href="https://www.blogger.com/null" name="wp1037514"></a> 
   <div class="pB1_Body1">
 The weight for a packet belonging to a specific class is derived from the bandwidth you assigned to the class when you configured it; in this sense the weight for a class is user-configurable. </div>
<a href="https://www.blogger.com/null" name="wp1037515"></a> 
   <div class="pB1_Body1">
 After a packet's weight is assigned, the packet is enqueued in the appropriate class queue. CBWFQ uses the weights assigned to the queued packets to ensure that the class queue is serviced fairly. </div>
<a href="https://www.blogger.com/null" name="wp1037516"></a> 
   <div class="pB1_Body1">
 The following tasks are required to configure CBWFQ: </div>
<a href="https://www.blogger.com/null" name="wp1037518"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037517"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Defining a Class Map </div>
<a href="https://www.blogger.com/null" name="wp1037519"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Configuring Class Policy in the Policy Map (Tail Drop) </div>
<a href="https://www.blogger.com/null" name="wp1037520"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Attaching the Service Policy and Enabling CBWFQ </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037521"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />Attaching a service policy to an interface disables WFQ on that interface if WFQ is configured for the interface. For this reason, you should ensure that WFQ is not enabled on such an interface. For additional information on WFQ, see the "Configuring Weighted Fair Queueing" chapter of the <span class="cXRef_Color" style="font-weight: normal;">Cisco IOS Release 12.0 Quality of Service Solutions Configuration Guide</span>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Defining_a_Class_Map"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037523"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037522"></a> 
   <h3 class="p_H_Head3">
 Defining a Class Map </h3>
<a href="https://www.blogger.com/null" name="wp1037524"></a> 
   <div class="pB1_Body1">
 To create a class map containing match criteria against which a packet is checked to determine if it belongs to a class, and to effectively create the class whose policy can be specified in one or more policy maps, use the first command in global configuration mode to specify the class-map name. Then use one of the following commands in class-map configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1037560"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1037529table1037525" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1037527"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037529"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037531"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037533"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037536"></a><a href="https://www.blogger.com/null" name="wpmkr1037535"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(config)# </code><span style="color: black; font-style: normal; font-weight: bold;">class-map</span><span style="color: black; font-style: normal; font-weight: normal;"> </span><span style="color: black; font-style: oblique; font-weight: normal;">class-map-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037538"></a><div class="pB1_Body1">
 Specifies the name of the class map to be created. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037540"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037543"></a><a href="https://www.blogger.com/null" name="wpmkr1037542"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose</code><b class="cBold" style="font-style: normal; font-weight: bold;">(config-cmap)# match access-group 
</b><span style="color: black; font-style: oblique; font-weight: normal;">access-group
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037545"></a><div class="pB1_Body1">
 <span class="cCp_CmdPlain">Specifies the name of the numbered ACL against whose contents packets are checked to determine if they belong to the class.</span> </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037547"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037550"></a><a href="https://www.blogger.com/null" name="wpmkr1037549"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose</code><b class="cBold">(config-cmap)# </b><code class="cExPlain" style="font-weight: normal;">match input-interface</code><span style="color: black; font-style: normal; font-weight: normal;"> 
</span><span style="color: black; font-style: oblique; font-weight: normal;">interface-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037552"></a><div class="pB1_Body1">
 Specifies the name of the output interface used as a match criterion against which packets are checked to determine if they belong to the class. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037554"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037557"></a><a href="https://www.blogger.com/null" name="wpmkr1037556"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose</code><b class="cBold" style="font-weight: bold;">(config-cmap)# </b><span style="color: black; font-style: normal; font-weight: bold;">match protocol</span> <span style="color: black; font-style: oblique; font-weight: normal;">protocol
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037559"></a><div class="pB1_Body1">
 Specifies the name of the protocol used as a match criterion against which packets are checked to determine if they belong to the class. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Configuring_Class_Policy_in_the_Policy_Map_(Tail_Drop)"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037564"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037561"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037562"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037563"></a> 
   <h3 class="p_H_Head3">
 Configuring Class Policy in the Policy Map (Tail Drop) </h3>
<a href="https://www.blogger.com/null" name="wp1037565"></a> 
   <div class="pB1_Body1">
 To configure a policy map and create class policies (including a default class) comprising the service policy, use the first global configuration command to specify the policy-map name. Then use the following policy-map configuration commands to configure policy for a standard class and the default class. For each class that you define, you can use one or more of the following policy-map configuration commands to configure class policy. For example, you might specify bandwidth for one class and both bandwidth and queue limit for another class. </div>
<a href="https://www.blogger.com/null" name="wp1037566"></a> 
   <div class="pB1_Body1">
 The policy-map default class is the class to which traffic is directed if that traffic does not satisfy the match criteria of other classes whose policy is defined in the policy map. To configure policy for more than one class in the same policy map, repeat Steps 2 through 4. Note that because this set of commands uses queue-limit, the policy map uses tail drop for both class policies, not WRED packet drop. </div>
<a href="https://www.blogger.com/null" name="wp1037567"></a> 
   <div class="pB1_Body1">
 To attach a service policy to an interface and enable CBWFQ on the interface, you must create a policy map. You can configure class policies for as many classes as are defined on the router up to the maximum of 64. </div>
<a href="https://www.blogger.com/null" name="wp1037622"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1037572table1037568" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1037570"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037572"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037574"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037576"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037579"></a><a href="https://www.blogger.com/null" name="wpmkr1037578"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# policy-map policy-map
</code></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037581"></a><div class="pB1_Body1">
 Specifies the name of the policy map to be created or modified. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037583"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037586"></a><a href="https://www.blogger.com/null" name="wpmkr1037585"></a> 
        <div class="pEx1_Example1">
 
         <pre>hq-sanjose(config-pmap)# <span style="color: black; font-style: normal; font-weight: bold;">class</span> <span style="color: black; font-style: oblique; font-weight: normal;">class-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037588"></a><div class="pB1_Body1">
 <span class="cCp_CmdPlain">Specifies the name of a class to be created and included in the service policy.</span> </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037590"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037593"></a><a href="https://www.blogger.com/null" name="wpmkr1037592"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-pmap-c)# bandwidth 
bandwidth-kbps
</code></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037595"></a><div class="pB1_Body1">
 Specifies the amount of bandwidth in kilobits per second (kbps) to be assigned to the class. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037597"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037600"></a><a href="https://www.blogger.com/null" name="wpmkr1037599"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose</code>(config-pmap-c)# <span style="color: black; font-style: normal; font-weight: bold;">queue-limit</span> 
<span style="color: black; font-style: oblique; font-weight: normal;">number-of-packets
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037602"></a><div class="pB1_Body1">
 Specifies the maximum number of packets that can be enqueued for the class. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037604"></a><div class="pCSN_CellStepnext">
 Step 5  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037607"></a><a href="https://www.blogger.com/null" name="wpmkr1037606"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(config-pmap)# </code><span style="color: black; font-style: normal; font-weight: bold;">class</span><span style="color: black; font-style: normal; font-weight: normal;"> </span><span style="color: black; font-style: oblique; font-weight: normal;">class-default</span><span style="color: black; font-style: normal; font-weight: normal;"> 
default-class-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037609"></a><div class="pB1_Body1">
 Specifies the default class in order to configure its policy. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037611"></a><div class="pCSN_CellStepnext">
 Step 6  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037613"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(config-pmap-c)# </code><span style="color: black; font-style: normal; font-weight: bold;">bandwidth</span><span style="color: black; font-style: normal; font-weight: normal;"> 
</span><span style="color: black; font-style: oblique; font-weight: normal;">bandwidth-kbps
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037615"></a><div class="pB1_Body1">
 Specifies the amount of bandwidth in kilobits per second to be assigned to the default class. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037617"></a><div class="pCSN_CellStepnext">
 Step 7  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037619"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(config-pmap-c)# </code><span style="color: black; font-style: normal; font-weight: bold;">queue-limit</span><span style="color: black; font-style: normal; font-weight: normal;"> 
</span><span style="color: black; font-style: oblique; font-weight: normal;">number-of-packets
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037621"></a><div class="pB1_Body1">
 Specifies the maximum number of packets that can be enqueued for the specified default class. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Attaching_the_Service_Policy_and_Enabling_CBWFQ"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037626"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037623"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037624"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037625"></a> 
   <h3 class="p_H_Head3">
 Attaching the Service Policy and Enabling CBWFQ </h3>
<a href="https://www.blogger.com/null" name="wp1037627"></a> 
   <div class="pB1_Body1">
 To attach a service policy to the output interface and enable CBWFQ on the interface, use the interface configuration command in the following table: </div>
<a href="https://www.blogger.com/null" name="wp1037638"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" id="wp1037630table1037628" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037630"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037632"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037635"></a><a href="https://www.blogger.com/null" name="wpmkr1037634"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose(config-if)# </code><span style="color: black; font-style: normal; font-weight: bold;">service-policy output policy-map
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037637"></a><div class="pB1_Body1">
 Enables CBWFQ and attaches the specified service policy map to the output interface. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<br /> 
   <div class="pTableAnchor">
 </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037639"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />When CBWFQ is enabled, all classes configured as part of the service policy map are installed in the fair queueing system. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Verifying_Class-Based_Weighted_Fair_Queuing"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037642"></a> 
   <a href="https://www.blogger.com/null" name="wpxref53248"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037641"></a> 
   <h3 class="p_H_Head2">
 Verifying Class-Based Weighted Fair Queuing </h3>
<a href="https://www.blogger.com/null" name="wp1037644"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037643"></a> 
   <div class="pB1_Body1">
 To display the contents of a specific policy map, a specific class from a specific policy map, or all policy maps configured on an interface, use one of the following global configuration commands: </div>
<a href="https://www.blogger.com/null" name="wp1037663"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" id="wp1037647table1037645" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037647"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037649"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037652"></a><a href="https://www.blogger.com/null" name="wpmkr1037651"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose# </code><span style="color: black; font-style: normal; font-weight: bold;">show policy policy-map
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037654"></a><div class="pB1_Body1">
 Displays the configuration of all classes comprising the specified policy map. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037656"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose# </code><span style="color: black; font-style: normal; font-weight: bold;">show policy policy-map  class 
</span><span style="color: black; font-style: oblique; font-weight: normal;">class-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037658"></a><div class="pB1_Body1">
 Displays the configuration of the specified class of the specified policy map. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037660"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain" style="font-weight: normal;">hq-sanjose# </code><span style="color: black; font-style: normal; font-weight: bold;">show policy interface</span><span style="color: black; font-style: normal; font-weight: normal;"> 
</span><span style="color: black; font-style: oblique; font-weight: normal;">interface-name
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037662"></a><div class="pB1_Body1">
 Displays the configuration of all classes configured for all policy maps on the specified interface. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<br /> 
   <div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Step_5-Configuring_Cisco_IOS_Firewall_Features"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037666"></a> 
   <a href="https://www.blogger.com/null" name="wpxref36975"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037665"></a> 
   <h2 class="p_H_Head1">
 Step 5—Configuring Cisco IOS Firewall Features </h2>
<a href="https://www.blogger.com/null" name="wp1037667"></a> 
   <div class="pB1_Body1">
 Cisco IOS software provides an extensive set of security features with which you can configure a simple or elaborate firewall, according to your particular requirements. When you configure Cisco IOS firewall features on your Cisco router, you turn your router into an effective, robust firewall. </div>
<a href="https://www.blogger.com/null" name="wp1037668"></a> 
   <div class="pB1_Body1">
 Cisco IOS firewall features are designed to prevent unauthorized, external individuals from gaining access to your internal network, and to block attacks on your network, while at the same time allowing authorized users to access network resources. </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037670"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037669"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />The Cisco Secure PIX Firewall can be used as an alternative to Cisco IOS firewall features. For detailed information on the Cisco Secure PIX Firewall, refer to the <span class="cXRef_Color" style="font-weight: normal;">Cisco Secure PIX Firewall</span> documentation. </div>
<hr class="Cautn1table" />
 
   <div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037673"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037672"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />Although Cisco 7200 series routers support intrusion detection features, intrusion detection configuration procedures are not explained in this guide. For detailed information on intrusion detection, refer to the <span class="cXRef_Color" style="font-style: normal; font-weight: normal;">Intrusion Detection Planning Guide</span><span style="color: black; font-style: italic; font-weight: normal;">. </span> </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037676"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037675"></a> 
   <div class="pB1_Body1">
 You can use Cisco IOS firewall features to configure your Cisco IOS router as: </div>
<a href="https://www.blogger.com/null" name="wp1037677"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />An Internet firewall or part of an Internet firewall </div>
<a href="https://www.blogger.com/null" name="wp1037678"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />A firewall between groups in your internal network </div>
<a href="https://www.blogger.com/null" name="wp1037679"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />A firewall providing secure connections to or from branch offices </div>
<a href="https://www.blogger.com/null" name="wp1037680"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />A firewall between your company network and your company partners networks </div>
<a href="https://www.blogger.com/null" name="wp1037682"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037681"></a> 
   <div class="pB1_Body1">
 Cisco IOS firewall features provide the following benefits: </div>
<a href="https://www.blogger.com/null" name="wp1037683"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Protects internal networks from intrusion </div>
<a href="https://www.blogger.com/null" name="wp1037684"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Monitors traffic through network perimeters </div>
<a href="https://www.blogger.com/null" name="wp1037685"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enables network commerce using the World Wide Web </div>
<a href="https://www.blogger.com/null" name="wp1037687"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037686"></a> 
   <div class="pB1_Body1">
 At a minimum, you must configure basic traffic filtering to provide a basic firewall. You can configure your Cisco 7200 series router to function as a firewall by using the following Cisco IOS security features: </div>
<a href="https://www.blogger.com/null" name="wp1037688"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Static access lists and static or dynamic extended access lists </div>
<a href="https://www.blogger.com/null" name="wp1037689"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Lock-and-key (dynamic extended access lists) </div>
<a href="https://www.blogger.com/null" name="wp1037690"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Reflective access lists </div>
<a href="https://www.blogger.com/null" name="wp1037691"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />TCP intercept </div>
<a href="https://www.blogger.com/null" name="wp1037692"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Context-based access control </div>
<a href="https://www.blogger.com/null" name="wp1037693"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Security server support </div>
<a href="https://www.blogger.com/null" name="wp1037694"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Network address translation </div>
<a href="https://www.blogger.com/null" name="wp1037695"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Cisco Encryption Technology </div>
<a href="https://www.blogger.com/null" name="wp1037696"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />IPSec network security </div>
<a href="https://www.blogger.com/null" name="wp1037697"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Neighbor router authentication </div>
<a href="https://www.blogger.com/null" name="wp1037698"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Event logging </div>
<a href="https://www.blogger.com/null" name="wp1037699"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />User authentication and authorization </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037702"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" /> Refer to the "Traffic Filtering and Firewalls" part of the <span style="color: black; font-style: italic; font-weight: normal;">Cisco IOS Security Configuration Guide</span> and the<span style="color: black; font-style: italic; font-weight: normal;"> Cisco IOS</span> <span style="color: black; font-style: italic; font-weight: normal;">Security Command Reference </span>for advanced firewall configuration information. For information on how to access these documents, see <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342prf.html#wpxref74569"><span class="cXRef_Color" style="font-weight: normal;">"Related Documentation" section on page xi</span></a>. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037703"></a> 
   <div class="pB1_Body1">
 This section explains how to configure an extended access list, which is a sequential collection of permit and deny conditions that apply to an IP address. </div>
<a href="https://www.blogger.com/null" name="wp1037704"></a> 
   <div class="pB1_Body1">
 This section includes the following topics: </div>
<a href="https://www.blogger.com/null" name="wp1037708"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037732">Creating Extended Access Lists Using Access List Numbers</a> </div>
<a href="https://www.blogger.com/null" name="wp1037712"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037763">Verifying Extended Access Lists</a> </div>
<a href="https://www.blogger.com/null" name="wp1037716"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037775">Applying Access Lists to Interfaces</a> </div>
<a href="https://www.blogger.com/null" name="wp1037720"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" /><a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1037821">Verifying Extended Access Lists Are Applied Correctly</a> </div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/note.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037722"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037721"></a> 
   <div class="pN1_Note1">
 <b>Note </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="1" />The extended access list configuration explained in this section is different from the crypto access list configuration explained in the <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1036823">"Creating Crypto Access Lists" section</a>. Crypto access lists are used to define which IP traffic is or is not protected by crypto, while an extended access list is used to determine which IP traffic to forward or block at an interface. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037726"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037727"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037728"></a> 
   <div class="pB1_Body1">
 The simplest connectivity to the Internet is to use a single device to provide the connectivity and firewall function to the Internet. With everything being in a single device, it is easy to address translation and termination of the VPN tunnels. Complexity arises when you need to add extra Cisco 7200 series routers to the network. This normally leads people into building a network where the corporate network touches the Internet through a network called the DMZ, or demilitarized zone. </div>
<a href="https://www.blogger.com/null" name="Creating_Extended_Access_Lists_Using_Access_List_Numbers"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037732"></a> 
   <a href="https://www.blogger.com/null" name="wpxref30547"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037730"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037731"></a> 
   <h3 class="p_H_Head2">
 Creating Extended Access Lists Using Access List Numbers </h3>
<a href="https://www.blogger.com/null" name="wp1037733"></a> 
   <div class="pB1_Body1">
 To create an extended access list that denies and permits certain types of traffic, complete the following steps starting in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1037760"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1037738table1037734" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1037736"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037738"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037740"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037742"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037745"></a><a href="https://www.blogger.com/null" name="wpmkr1037744"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">access-list 102 deny tcp any 
any
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037747"></a><div class="pB1_Body1">
 Define access list 102 and configure the access list to deny all TCP traffic. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037749"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037751"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">access-list 102 deny udp any 
any
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037753"></a><div class="pB1_Body1">
 Configure access list 102 to deny all UDP traffic. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037755"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037757"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">access-list 102 permit ip 
any any
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037759"></a><div class="pB1_Body1">
 Configure access list 102 to permit all IP traffic. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Verifying_Extended_Access_Lists"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037763"></a> 
   <a href="https://www.blogger.com/null" name="wpxref41710"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037762"></a> 
   <h3 class="p_H_Head2">
 Verifying Extended Access Lists </h3>
<a href="https://www.blogger.com/null" name="wp1037764"></a> 
   <div class="pB1_Body1">
 To verify the configuration: </div>
<a href="https://www.blogger.com/null" name="wp1037766"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037765"></a> 
   <div class="pB1_Body1">
 Enter the <b class="cBold">show access-lists 102</b> EXEC command to display the contents of the access list. </div>
<a href="https://www.blogger.com/null" name="wp1037767"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show access-list 102
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037768"></a> 
   <div class="pEx1_Example1">
 
    <pre>Extended IP access list 102
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037769"></a> 
   <div class="pEx1_Example1">
 
    <pre>    deny   tcp any any
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037770"></a> 
   <div class="pEx1_Example1">
 
    <pre>    deny   udp any any
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037771"></a> 
   <div class="pEx1_Example1">
 
    <pre>    permit ip any any
</pre>
</div>
<a href="https://www.blogger.com/null" name="Applying_Access_Lists_to_Interfaces"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037775"></a> 
   <a href="https://www.blogger.com/null" name="wpxref38202"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037773"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037774"></a> 
   <h3 class="p_H_Head2">
 Applying Access Lists to Interfaces </h3>
<a href="https://www.blogger.com/null" name="wp1037777"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037776"></a> 
   <div class="pB1_Body1">
 After you create an access list, you can apply it to one or more interfaces. Access lists can be applied on <span style="color: black; font-style: italic; font-weight: normal;">either </span>outbound or inbound interfaces. </div>
<a href="https://www.blogger.com/null" name="wp1037778"></a> 
   <div class="pB1_Body1">
 To apply an access list inbound and outbound on an interface, complete the following steps starting in global configuration mode: </div>
<a href="https://www.blogger.com/null" name="wp1037811"></a> 
   <div class="pTableAnchor">
 </div>
<div align="left">
 
    <table border="1" cellpadding="3" cellspacing="0" class="steptable" id="wp1037783table1037779" style="width: 80%px;"> 
     <caption><br /></caption> 
     <tbody>
<tr align="left" valign="bottom"> 
       <th scope="col"> <a href="https://www.blogger.com/null" name="wp1037781"></a></th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037783"></a> 
        <div class="pCH1_CellHead1">
          Command 
        </div>
</th> 
       <th scope="col"><a href="https://www.blogger.com/null" name="wp1037785"></a> 
        <div class="pCH1_CellHead1">
          Purpose 
        </div>
</th> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037787"></a><div class="pCSF_CellStepFirst">
 Step 1  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037789"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config)# </code><b class="cBold">interface serial 1/0
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037791"></a><div class="pB1_Body1">
 Specify serial interface 1/0 on the headquarters router and enter interface configuration mode. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037793"></a><div class="pCSN_CellStepnext">
 Step 2  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037796"></a><a href="https://www.blogger.com/null" name="wpmkr1037795"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold">ip access-group 102 in
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037798"></a><div class="pB1_Body1">
 Configure access list 102 inbound on serial interface 1/0 on the headquarters router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037800"></a><div class="pCSN_CellStepnext">
 Step 3  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037802"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold">ip access-group 102 out
</b></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037804"></a><div class="pB1_Body1">
 Configure access list 102 outbound on serial interface 1/0 on the headquarters router. </div>
</td> 
      </tr>
<tr align="left" valign="top"> 
       <td><a href="https://www.blogger.com/null" name="wp1037806"></a><div class="pCSN_CellStepnext">
 Step 4  </div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037808"></a> 
        <div class="pEx1_Example1">
 
         <pre><code class="cExPlain">hq-sanjose(config-if)# </code><b class="cBold" style="font-weight: bold;">exit 
</b><span style="color: black; font-style: normal; font-weight: normal;">hq-sanjose(config)#
</span></pre>
</div>
</td> 
       <td><a href="https://www.blogger.com/null" name="wp1037810"></a><div class="pB1_Body1">
 Exit back to global configuration mode. </div>
</td> 
      </tr>
</tbody> 
    </table>
</div>
<div class="pTableAnchor">
 </div>
<a href="https://www.blogger.com/null" name="wp1037813"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037812"></a> 
   <div class="pB1_Body1">
 For inbound access lists, after receiving a packet, the Cisco IOS software checks the source address of the packet against the access list. If the access list permits the address, the software continues to process the packet. If the access list rejects the address, the software discards the packet and returns an "icmp host<em class="cCi_CmdItalic"> </em>unreachable" message. </div>
<a href="https://www.blogger.com/null" name="wp1037814"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037815"></a> 
   <div class="pB1_Body1">
 For outbound access lists, after receiving and routing a packet to a controlled interface, the software checks the destination address of the packet against the access list. If the access list permits the address, the software transmits the packet. If the access list rejects the address, the software discards the packet and returns an "ICMP Host Unreachable" message. </div>
<a href="https://www.blogger.com/null" name="wp1037817"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037816"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037818"></a> 
   <div class="pB1_Body1">
 When you apply an access list that has not yet been defined to an interface, the software acts as if the access list has not been applied to the interface and will accept all packets. Be aware of this behavior if you use undefined access lists as a means of security in your network. </div>
<a href="https://www.blogger.com/null" name="Verifying_Extended_Access_Lists_Are_Applied_Correctly"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037821"></a> 
   <a href="https://www.blogger.com/null" name="wpxref28249"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037820"></a> 
   <h3 class="p_H_Head2">
 Verifying Extended Access Lists Are Applied Correctly </h3>
<a href="https://www.blogger.com/null" name="wp1037822"></a> 
   <div class="pB1_Body1">
 To verify the configuration: </div>
<a href="https://www.blogger.com/null" name="wp1037824"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037823"></a> 
   <div class="pBu1_Bullet1">
 •<img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="19" />Enter the <b class="cBold">show ip interface serial 1/0</b> EXEC command to confirm the access list is applied correctly (inbound and outbound) on the interface. </div>
<a href="https://www.blogger.com/null" name="wp1037825"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show ip interface serial 1/0
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037826"></a> 
   <div class="pEx1_Example1">
 
    <pre>Serial1/0 is up, line protocol is up
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037827"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Internet address is 172.17.2.4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037828"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Broadcast address is 255.255.255.255
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037829"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Address determined by setup command
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037830"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Peer address is 172.24.2.5 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037831"></a> 
   <div class="pEx1_Example1">
 
    <pre>  MTU is 1500 bytes
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037832"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Helper address is not set
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037833"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Directed broadcast forwarding is disabled
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037834"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Outgoing access list is 102
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037835"></a> 
   <div class="pEx1_Example1">
 
    <pre>  Inbound  access list is 102
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1037836"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037837"></a> 
   <div class="pEx1_Example1">
 
    <pre>  -Display text omitted-
</pre>
</div>
<div class="Note1B">
 
    <img alt="" src="http://www.cisco.com/c/dam/en/us/td/i/templates/tip.gif" /> 
   </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="wp1037839"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037838"></a> 
   <div class="pTip">
 <b>Tip </b><img alt="" border="0" height="2" src="http://www.cisco.com/c/dam/en/us/td/i/templates/blank.gif" width="8" />If you have trouble, ensure that you specified the correct interface when you applied the access list. </div>
<hr class="Cautn1table" />
 
   <a href="https://www.blogger.com/null" name="Comprehensive_Configuration_Examples"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037842"></a> 
   <a href="https://www.blogger.com/null" name="wpxref39766"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037841"></a> 
   <h2 class="p_H_Head1">
 Comprehensive Configuration Examples </h2>
<a href="https://www.blogger.com/null" name="wp1037843"></a> 
   <div class="pB1_Body1">
 Following are comprehensive sample configurations for the site-to-site and extranet scenarios. </div>
<a href="https://www.blogger.com/null" name="Site-to-Site_Scenario"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037844"></a> 
   <h3 class="p_H_Head2">
 Site-to-Site Scenario </h3>
<a href="https://www.blogger.com/null" name="wp1037848"></a> 
   <div class="pB1_Body1">
 The following sample configuration is based on the physical elements shown in <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1045775">Figure 3-8</a>: </div>
<a href="https://www.blogger.com/null" name="wp1045775"></a> 
   <a href="https://www.blogger.com/null" name="wpxref60720"></a> 
   <div class="pTC_TableCap">
 Figure 3-8 Site-to-Site VPN Scenario Physical Elements </div>
<a href="https://www.blogger.com/null" name="wp1045779"></a> 
   <div class="pGraphicAnchor">
 </div>
<div align="left">
 
    <img border="0" hspace="0" id="wp1045777" src="http://www.cisco.com/c/dam/en/us/td/i/000001-100000/20001-25000/23001-23500/23245.ps/_jcr_content/renditions/23245.jpg" vspace="0" /> 
   </div>
<div class="pGraphicAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Headquarters_Router_Configuration"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037857"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037856"></a> 
   <h3 class="p_H_Head3">
 Headquarters Router Configuration </h3>
<a href="https://www.blogger.com/null" name="wp1037858"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show running-config
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037859"></a> 
   <div class="pEx1_Example1">
 
    <pre>Building configuration...
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1037860"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037861"></a> 
   <div class="pEx1_Example1">
 
    <pre>Current configuration:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037862"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037863"></a> 
   <div class="pEx1_Example1">
 
    <pre>version 12.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037864"></a> 
   <div class="pEx1_Example1">
 
    <pre>service timestamps debug uptime
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037865"></a> 
   <div class="pEx1_Example1">
 
    <pre>service timestamps log uptime
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037866"></a> 
   <div class="pEx1_Example1">
 
    <pre>no service password-encryption
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037867"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037868"></a> 
   <div class="pEx1_Example1">
 
    <pre>hostname hq-sanjose
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037869"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1053289"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot system flash bootflash:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1053363"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot bootldr bootflash:c7200-jk9o3s-mz.123-3
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037872"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot config slot0:hq-sanjose-cfg-small
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037873"></a> 
   <div class="pEx1_Example1">
 
    <pre>no logging buffered
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037874"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037875"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto isakmp policy 1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037876"></a> 
   <div class="pEx1_Example1">
 
    <pre> authentication pre-share
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037877"></a> 
   <div class="pEx1_Example1">
 
    <pre> lifetime 84600
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037878"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto isakmp key test12345 address 172.24.2.5
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037879"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037880"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto ipsec transform-set proposal1 ah-sha-hmac esp-des esp-sha-hmac 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037881"></a> 
   <div class="pEx1_Example1">
 
    <pre>mode transport
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037882"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037883"></a> 
   <div class="pEx1_Example1">
 
    <pre> !
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037884"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first local-address Serial1/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037885"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first 1 ipsec-isakmp  
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037886"></a> 
   <div class="pEx1_Example1">
 
    <pre> set peer 172.24.2.5
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037887"></a> 
   <div class="pEx1_Example1">
 
    <pre> set transform-set proposal1 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037888"></a> 
   <div class="pEx1_Example1">
 
    <pre> match address 101
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037889"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037890"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface Tunnel0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037891"></a> 
   <div class="pEx1_Example1">
 
    <pre> bandwidth 180
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037892"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 172.17.3.3 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037893"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037894"></a> 
   <div class="pEx1_Example1">
 
    <pre> tunnel source 172.17.2.4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037895"></a> 
   <div class="pEx1_Example1">
 
    <pre> tunnel destination 172.24.2.5
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037896"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037897"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037898"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface FastEthernet0/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037899"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 10.1.3.3 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037900"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037901"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037902"></a> 
   <div class="pEx1_Example1">
 
    <pre> full-duplex
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037903"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037904"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037905"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface FastEthernet0/1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037906"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 10.1.6.4 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037907"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037908"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037909"></a> 
   <div class="pEx1_Example1">
 
    <pre> full-duplex
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037910"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037911"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037912"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface Serial1/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037913"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 172.17.2.4 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037914"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037915"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip mroute-cache
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037916"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037917"></a> 
   <div class="pEx1_Example1">
 
    <pre> fair-queue 64 256 0    
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037918"></a> 
   <div class="pEx1_Example1">
 
    <pre> framing c-bit
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037919"></a> 
   <div class="pEx1_Example1">
 
    <pre> cablelength 10
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037920"></a> 
   <div class="pEx1_Example1">
 
    <pre> dsu bandwidth 44210
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037921"></a> 
   <div class="pEx1_Example1">
 
    <pre> clock source internal
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037922"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037923"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037924"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037925"></a> 
   <div class="pEx1_Example1">
 
    <pre>ip route 10.1.4.0 255.255.255.0 Tunnel0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037926"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037927"></a> 
   <div class="pEx1_Example1">
 
    <pre>access-list 101 permit gre host 172.17.2.4 host 172.24.2.5
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037928"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037929"></a> 
   <div class="pEx1_Example1">
 
    <pre>line con 0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037930"></a> 
   <div class="pEx1_Example1">
 
    <pre> transport input none
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037931"></a> 
   <div class="pEx1_Example1">
 
    <pre>line aux 0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037932"></a> 
   <div class="pEx1_Example1">
 
    <pre>line vty 0 4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037933"></a> 
   <div class="pEx1_Example1">
 
    <pre> login
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037934"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037936"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037935"></a> 
   <div class="pEx1_Example1">
 
    <pre>end
</pre>
</div>
<a href="https://www.blogger.com/null" name="Remote_Office_Router_Configuration"> </a> 
   <a href="https://www.blogger.com/null" name="wp1037938"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1037937"></a> 
   <h3 class="p_H_Head3">
 Remote Office Router Configuration </h3>
<a href="https://www.blogger.com/null" name="wp1037939"></a> 
   <div class="pEx1_Example1">
 
    <pre>ro-rtp# <b class="cBold">show running-config
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037940"></a> 
   <div class="pEx1_Example1">
 
    <pre>Building configuration...
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1037941"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037942"></a> 
   <div class="pEx1_Example1">
 
    <pre>Current configuration:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037943"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037944"></a> 
   <div class="pEx1_Example1">
 
    <pre>version 12.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037945"></a> 
   <div class="pEx1_Example1">
 
    <pre>service timestamps debug uptime
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037946"></a> 
   <div class="pEx1_Example1">
 
    <pre>service timestamps log uptime
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037947"></a> 
   <div class="pEx1_Example1">
 
    <pre>no service password-encryption
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037948"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037949"></a> 
   <div class="pEx1_Example1">
 
    <pre>hostname ro-rtp
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037950"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037951"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot system flash bootflash:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037952"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot bootldr bootflash:c7200-jk9o3s-mz.123-3
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037953"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot config slot0:ro-rtp-cfg-small
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037954"></a> 
   <div class="pEx1_Example1">
 
    <pre>no logging buffered
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037955"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037956"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto isakmp policy 1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037957"></a> 
   <div class="pEx1_Example1">
 
    <pre> authentication pre-share
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037958"></a> 
   <div class="pEx1_Example1">
 
    <pre> lifetime 84600
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037959"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto isakmp key test12345 address 172.17.2.4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037960"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037961"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto ipsec transform-set proposal1 ah-sha-hmac esp-des esp-sha-hmac 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037962"></a> 
   <div class="pEx1_Example1">
 
    <pre>mode transport
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037963"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037964"></a> 
   <div class="pEx1_Example1">
 
    <pre> !
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037965"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first local-address Serial1/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037966"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first 1 ipsec-isakmp  
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037967"></a> 
   <div class="pEx1_Example1">
 
    <pre> set peer 172.17.2.4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037968"></a> 
   <div class="pEx1_Example1">
 
    <pre> set transform-set proposal1 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037969"></a> 
   <div class="pEx1_Example1">
 
    <pre> match address 101
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037970"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037971"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface Tunnel1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037972"></a> 
   <div class="pEx1_Example1">
 
    <pre> bandwidth 180
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037973"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 172.24.3.6 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037974"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037975"></a> 
   <div class="pEx1_Example1">
 
    <pre> tunnel source 172.24.2.5
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037976"></a> 
   <div class="pEx1_Example1">
 
    <pre> tunnel destination 172.17.2.4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037977"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037978"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037979"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface FastEthernet0/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037980"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 10.1.4.2 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037981"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037982"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037983"></a> 
   <div class="pEx1_Example1">
 
    <pre> full-duplex
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037984"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037985"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037986"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface Serial1/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037987"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 172.24.2.5 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037988"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037989"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip mroute-cache
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037990"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037991"></a> 
   <div class="pEx1_Example1">
 
    <pre> fair-queue 64 256 0    
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037992"></a> 
   <div class="pEx1_Example1">
 
    <pre> framing c-bit
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037993"></a> 
   <div class="pEx1_Example1">
 
    <pre> cablelength 10
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037994"></a> 
   <div class="pEx1_Example1">
 
    <pre> dsu bandwidth 44210
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037995"></a> 
   <div class="pEx1_Example1">
 
    <pre> clock source internal
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037996"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037997"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037998"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1037999"></a> 
   <div class="pEx1_Example1">
 
    <pre>ip route 10.1.3.0 255.255.255.0 Tunnel1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038000"></a> 
   <div class="pEx1_Example1">
 
    <pre>ip route 10.1.6.0 255.255.255.0 Tunnel1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038001"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038002"></a> 
   <div class="pEx1_Example1">
 
    <pre>access-list 101 permit gre host 172.24.2.5 host 172.17.2.4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038003"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038004"></a> 
   <div class="pEx1_Example1">
 
    <pre>line con 0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038005"></a> 
   <div class="pEx1_Example1">
 
    <pre> transport input none
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038006"></a> 
   <div class="pEx1_Example1">
 
    <pre>line aux 0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038007"></a> 
   <div class="pEx1_Example1">
 
    <pre>line vty 0 4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038008"></a> 
   <div class="pEx1_Example1">
 
    <pre> login
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038009"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038012"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1038010"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1038011"></a> 
   <div class="pEx1_Example1">
 
    <pre>end
</pre>
</div>
<a href="https://www.blogger.com/null" name="Extranet_Scenario"> </a> 
   <a href="https://www.blogger.com/null" name="wp1038013"></a> 
   <h3 class="p_H_Head2">
 Extranet Scenario </h3>
<a href="https://www.blogger.com/null" name="wp1038017"></a> 
   <div class="pB1_Body1">
 The following sample configuration is based on the physical elements shown in <a href="http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html#wp1038020">Figure 3-9</a>: </div>
<a href="https://www.blogger.com/null" name="wp1038020"></a> 
   <a href="https://www.blogger.com/null" name="wpxref84485"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1038019"></a> 
   <div class="pTC_TableCap">
 Figure 3-9 Extranet VPN Scenario Physical Elements </div>
<a href="https://www.blogger.com/null" name="wp1038024"></a> 
   <div class="pGraphicAnchor">
 </div>
<div align="left">
 
    <img border="0" hspace="0" id="wp1038022" src="http://www.cisco.com/c/dam/en/us/td/i/000001-100000/20001-25000/24001-24500/24218.ps/_jcr_content/renditions/24218.jpg" vspace="0" /> 
   </div>
<div class="pGraphicAnchor">
 </div>
<a href="https://www.blogger.com/null" name="Headquarters_Router_Configuration"> </a> 
   <a href="https://www.blogger.com/null" name="wp1038027"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1038025"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1038026"></a> 
   <h3 class="p_H_Head3">
 Headquarters Router Configuration </h3>
<a href="https://www.blogger.com/null" name="wp1038028"></a> 
   <div class="pEx1_Example1">
 
    <pre>hq-sanjose# <b class="cBold">show running-config
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038029"></a> 
   <div class="pEx1_Example1">
 
    <pre>Building configuration...
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1038030"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038031"></a> 
   <div class="pEx1_Example1">
 
    <pre>Current configuration:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038032"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038033"></a> 
   <div class="pEx1_Example1">
 
    <pre>version 12.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038034"></a> 
   <div class="pEx1_Example1">
 
    <pre>service timestamps debug uptime
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038035"></a> 
   <div class="pEx1_Example1">
 
    <pre>service timestamps log uptime
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038036"></a> 
   <div class="pEx1_Example1">
 
    <pre>no service password-encryption
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038037"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038038"></a> 
   <div class="pEx1_Example1">
 
    <pre>hostname hq-sanjose
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038039"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038040"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot system flash bootflash:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038041"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot bootldr bootflash:c7200-jk9o3s-mz.123-3
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038042"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot config slot0:hq-sanjose-cfg-small
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038043"></a> 
   <div class="pEx1_Example1">
 
    <pre>no logging buffered
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038044"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038045"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto isakmp policy 1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038046"></a> 
   <div class="pEx1_Example1">
 
    <pre> authentication pre-share
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038047"></a> 
   <div class="pEx1_Example1">
 
    <pre> lifetime 84600
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038048"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto isakmp key test12345 address 172.24.2.5
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038049"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto isakmp key test67890 address 172.23.2.7
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038050"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038051"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto ipsec transform-set proposal1 ah-sha-hmac esp-des esp-sha-hmac 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038052"></a> 
   <div class="pEx1_Example1">
 
    <pre>mode transport
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038053"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038054"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto ipsec transform-set proposal4 ah-sha-hmac esp-des esp-sha-hmac 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038055"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038056"></a> 
   <div class="pEx1_Example1">
 
    <pre> !
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038057"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first local-address Serial1/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038058"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first 1 ipsec-isakmp  
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038059"></a> 
   <div class="pEx1_Example1">
 
    <pre> set peer 172.24.2.5
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038060"></a> 
   <div class="pEx1_Example1">
 
    <pre> set transform-set proposal1 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038061"></a> 
   <div class="pEx1_Example1">
 
    <pre> match address 101
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038062"></a> 
   <div class="pEx1_Example1">
 
    <pre> !
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038063"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s4second local-address Serial2/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038064"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s4second 2 ipsec-isakmp  
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038065"></a> 
   <div class="pEx1_Example1">
 
    <pre> set peer 172.23.2.7
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038066"></a> 
   <div class="pEx1_Example1">
 
    <pre> set transform-set proposal4 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038067"></a> 
   <div class="pEx1_Example1">
 
    <pre> match address 111
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038068"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038069"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface Tunnel0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038070"></a> 
   <div class="pEx1_Example1">
 
    <pre> bandwidth 180
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038071"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 172.17.3.3 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038072"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038073"></a> 
   <div class="pEx1_Example1">
 
    <pre> tunnel source 172.17.2.4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038074"></a> 
   <div class="pEx1_Example1">
 
    <pre> tunnel destination 172.24.2.5
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038075"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038076"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038077"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface FastEthernet0/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038078"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 10.1.3.3 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038079"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038080"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038081"></a> 
   <div class="pEx1_Example1">
 
    <pre> full-duplex
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038082"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038083"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038084"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface FastEthernet0/1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038085"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 10.1.6.4 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038086"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038087"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip nat inside
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038088"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038089"></a> 
   <div class="pEx1_Example1">
 
    <pre> full-duplex
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038090"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038091"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038092"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface Serial1/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038093"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 172.17.2.4 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038094"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038095"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip mroute-cache
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038096"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038097"></a> 
   <div class="pEx1_Example1">
 
    <pre> fair-queue 64 256 0    
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038098"></a> 
   <div class="pEx1_Example1">
 
    <pre> framing c-bit
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038099"></a> 
   <div class="pEx1_Example1">
 
    <pre> cablelength 10
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038100"></a> 
   <div class="pEx1_Example1">
 
    <pre> dsu bandwidth 44210
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038101"></a> 
   <div class="pEx1_Example1">
 
    <pre> clock source internal
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038102"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038103"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s1first
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038104"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038105"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface Serial2/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038106"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 172.16.2.2 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038107"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038108"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip nat outside
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038109"></a> 
   <div class="pEx1_Example1">
 
    <pre>no ip mroute-cache
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038110"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038111"></a> 
   <div class="pEx1_Example1">
 
    <pre> fair-queue 64 256 0    
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038112"></a> 
   <div class="pEx1_Example1">
 
    <pre> framing c-bit
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038113"></a> 
   <div class="pEx1_Example1">
 
    <pre> cablelength 10
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038114"></a> 
   <div class="pEx1_Example1">
 
    <pre> dsu bandwidth 44210
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038115"></a> 
   <div class="pEx1_Example1">
 
    <pre> clock source internal
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038116"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038117"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s4second
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038118"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038119"></a> 
   <div class="pEx1_Example1">
 
    <pre>router bgp 10
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038120"></a> 
   <div class="pEx1_Example1">
 
    <pre> network 10.2.2.2 mask 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038121"></a> 
   <div class="pEx1_Example1">
 
    <pre> network 172.16.2.0 mask 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038122"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038123"></a> 
   <div class="pEx1_Example1">
 
    <pre>ip route 10.1.4.0 255.255.255.0 Tunnel0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038124"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038125"></a> 
   <div class="pEx1_Example1">
 
    <pre>ip nat inside source static 10.1.6.5 10.2.2.2
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038126"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038127"></a> 
   <div class="pEx1_Example1">
 
    <pre>access-list 101 permit gre host 172.17.2.4 host 172.24.2.5
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038128"></a> 
   <div class="pEx1_Example1">
 
    <pre>access-list 111 permit ip host 10.2.2.2 host 10.1.5.3
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038129"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038130"></a> 
   <div class="pEx1_Example1">
 
    <pre>line con 0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038131"></a> 
   <div class="pEx1_Example1">
 
    <pre> transport input none
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038132"></a> 
   <div class="pEx1_Example1">
 
    <pre>line aux 0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038133"></a> 
   <div class="pEx1_Example1">
 
    <pre>line vty 0 4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038134"></a> 
   <div class="pEx1_Example1">
 
    <pre> login
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038135"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038138"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1038136"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1038137"></a> 
   <div class="pEx1_Example1">
 
    <pre>end
</pre>
</div>
<a href="https://www.blogger.com/null" name="Business_Partner_Router_Configuration"> </a> 
   <a href="https://www.blogger.com/null" name="wp1038141"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1038139"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1038140"></a> 
   <h3 class="p_H_Head3">
 Business Partner Router Configuration </h3>
<a href="https://www.blogger.com/null" name="wp1038142"></a> 
   <div class="pEx1_Example1">
 
    <pre>bus-ptnr# <b class="cBold">show running-config
</b></pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038143"></a> 
   <div class="pEx1_Example1">
 
    <pre>Building configuration...
</pre>
</div>
<div class="pPreformatted">
 
    <pre class="pPreformatted"><a href="https://www.blogger.com/null" name="wp1038144"></a>
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038145"></a> 
   <div class="pEx1_Example1">
 
    <pre>Current configuration:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038146"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038147"></a> 
   <div class="pEx1_Example1">
 
    <pre>version 12.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038148"></a> 
   <div class="pEx1_Example1">
 
    <pre>service timestamps debug uptime
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038149"></a> 
   <div class="pEx1_Example1">
 
    <pre>service timestamps log uptime
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038150"></a> 
   <div class="pEx1_Example1">
 
    <pre>no service password-encryption
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038151"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038152"></a> 
   <div class="pEx1_Example1">
 
    <pre>hostname bus-ptnr
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038153"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038154"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot system flash bootflash:
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038155"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot bootldr bootflash:c7200-jk9o3s-mz.123-3
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038156"></a> 
   <div class="pEx1_Example1">
 
    <pre>boot config slot0:bus-ptnr-cfg-small
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038157"></a> 
   <div class="pEx1_Example1">
 
    <pre>no logging buffered
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038158"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038159"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto isakmp policy 1
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038160"></a> 
   <div class="pEx1_Example1">
 
    <pre> authentication pre-share
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038161"></a> 
   <div class="pEx1_Example1">
 
    <pre> lifetime 84600
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038162"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto isakmp key test67890 address 172.16.2.2
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038163"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038164"></a> 
   <div class="pEx1_Example1">
 
    <pre>crypto ipsec transform-set proposal4 ah-sha-hmac esp-des esp-sha-hmac 
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038165"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038166"></a> 
   <div class="pEx1_Example1">
 
    <pre> !
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038167"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s4second local-address Serial1/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038168"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s4second 2 ipsec-isakmp  
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038169"></a> 
   <div class="pEx1_Example1">
 
    <pre> set peer 172.16.2.2
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038170"></a> 
   <div class="pEx1_Example1">
 
    <pre> set transform-set proposal4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038171"></a> 
   <div class="pEx1_Example1">
 
    <pre> match address 111
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038172"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038173"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface FastEthernet0/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038174"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 10.1.5.2 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038175"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038176"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038177"></a> 
   <div class="pEx1_Example1">
 
    <pre> full-duplex
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038178"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038179"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038180"></a> 
   <div class="pEx1_Example1">
 
    <pre>interface Serial1/0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038181"></a> 
   <div class="pEx1_Example1">
 
    <pre> ip address 172.23.2.7 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038182"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip directed-broadcast
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038183"></a> 
   <div class="pEx1_Example1">
 
    <pre> no ip mroute-cache
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038184"></a> 
   <div class="pEx1_Example1">
 
    <pre> no keepalive
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038185"></a> 
   <div class="pEx1_Example1">
 
    <pre> fair-queue 64 256 0    
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038186"></a> 
   <div class="pEx1_Example1">
 
    <pre> framing c-bit
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038187"></a> 
   <div class="pEx1_Example1">
 
    <pre> cablelength 10
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038188"></a> 
   <div class="pEx1_Example1">
 
    <pre> dsu bandwidth 44210
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038189"></a> 
   <div class="pEx1_Example1">
 
    <pre> clock source internal
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038190"></a> 
   <div class="pEx1_Example1">
 
    <pre> no cdp enable
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038191"></a> 
   <div class="pEx1_Example1">
 
    <pre> crypto map s4second
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038192"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038193"></a> 
   <div class="pEx1_Example1">
 
    <pre>router bgp 10
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038194"></a> 
   <div class="pEx1_Example1">
 
    <pre> network 10.1.5.0 mask 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038195"></a> 
   <div class="pEx1_Example1">
 
    <pre> network 172.16.2.0 mask 255.255.255.0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038196"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038197"></a> 
   <div class="pEx1_Example1">
 
    <pre>access-list 111 permit ip host 10.1.5.3 host 10.2.2.2
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038198"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038199"></a> 
   <div class="pEx1_Example1">
 
    <pre>line con 0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038200"></a> 
   <div class="pEx1_Example1">
 
    <pre> transport input none
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038201"></a> 
   <div class="pEx1_Example1">
 
    <pre>line aux 0
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038202"></a> 
   <div class="pEx1_Example1">
 
    <pre>line vty 0 4
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038203"></a> 
   <div class="pEx1_Example1">
 
    <pre> login
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038204"></a> 
   <div class="pEx1_Example1">
 
    <pre>!
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1038206"></a> 
   <a href="https://www.blogger.com/null" name="wpmkr1038205"></a> 
   <div class="pEx1_Example1">
 
    <pre>end
</pre>
</div>
<a href="https://www.blogger.com/null" name="wp1017196"></a> 
  </blockquote>
<hr noshade="noshade" />

</div>
</div>
</div>
</td>
  </tr>
<tr align="left" valign="top">
      <td>
          <div class="left-col-min-width">
              <wbr></wbr>
          </div>
</td>

<a href="https://www.blogger.com/null" name="pagefooter"></a>
<div id="framework-footer">
    
    <div id="footer-legal">
        <a href="http://www.cisco.com/web/siteassets/legal/terms_condition.html">Terms & Conditions</a> |
        <a href="http://www.cisco.com/web/siteassets/legal/privacy_full.html">Privacy Statement</a> |
        <a href="http://www.cisco.com/web/siteassets/legal/privacy_full.html#cookies">Cookie Policy</a> |
        <a href="http://www.cisco.com/web/siteassets/legal/trademark.html">Trademarks</a>
    </div>
</div>
</div>
</div>
<div class="right-col-min-width">
              <wbr></wbr>
          </div>
</td></tr>
</tbody></table>

how to configure vpn in cisco router

Site-to-Site and Extranet VPN Business Scenarios Cisco IOS VPN Co…

15 Nov 2015

Load more posts

WORLD GOSSPERS ORGANISATION

How to Set Up Your Own Home VPN Server

how to configure vpn in cisco router

Popular Posts

Blogroll

Blog Archive