--Internet协议的 安全 体系结构
--IKE(Internet密钥交换)
--DES(数据加密标准)
--MD5
--SHA
--AH(Authentication Header,认证首部)数据认证和反重演(anti-reply)服务
--ESP(Encapsulation Security Payload,封装安全净荷)数据隐私、数据验证以及反重演(anti-reply)服务
(global)crypto ipsec security-association lifetime seconds seconds
(global)crypto ipsec security-association lifetime killobytes kilobytes
(global)access-list access-list-number ....
或者
(global)ip access-list extended name
扩展的访问列表必须定义由IPSec保护哪种IP流量。保密图(crypto map)援引这个访问列表来确定在接口上要保护的流量。
(1)创建变换集
(global)crypto ipsec transform-set name [transform1 | transform2 | transform3]
可以在一个保密图(crypto map)中定义多个变换集。如果没有使用IKE,那么只能定义一种变换集。用户能够选择多达三种变换。
(可选)选择一种AH变换
--ah-md5-hmac
--ah-sha-hmac
--ah-rfc-1828
(可选)选择一种ESP加密编号
--esp-des
--esp-3des
--esp-rfc-1829
--esp-null
以及这些验证方法之一
--esp-md5-hmac
--esp-sha-hmac
(可选)选择IP压缩变换
--comp-lzs
(crypto-transform)mode {tunnel | transport}
保密图(crypto map)连接了保密访问列表,确定了远程对等端、本地地址、变换集和协商方法。
--创建保密图
(global)crypto map map-name sequence ipsec-manual
(crypto-map)match address access-list
(crypto-map)set peer {hostname | ip_addr}
(crypto-map)set transform-set name
变换集必须和远程对等端上使用的相同
(crypto-map)set session-key inbound ah spi hex-key-data
(crypto-map)set session-key outbound ah spi hex-key-data
(crypto-map)set session-key inbound ah spi hex-key-data [authenticator hex-key-data]
(crypto-map)set session-key outbound ah spi hex-key-data [authenticator hex-key-data]
--创建保密图
(global)crypto map map-name sequence ipsec-isakmp
(crypto-map)match address access-list
(crypto-map)set peer {hostname | ip_addr}
(crypto-map)set transform-set name
变换集必须和远程对等端上使用的相同
(crypto-map)set security-association lifetime seconds seconds
(crypto-map)set security-association lifetime kilobytes kilobytes
(crypto-map)set security-association level per-host
(crypto-map)set pfs [group1 | group2]
--创建动态的保密图
(global)crypto dynamic-map dyn-map-name dyn-seq-num
(crypto-map)match address access-list
(crypto-map)set peer {hostname | ip_addr}
(crypto-map)set transform-set tranform-set-name
(crypto-map)set security-association lifetime seconds seconds
(crypto-map)set security-association lifetime kilobytes kilobytes
(crypto-map)set pfs [group1 | group2]
(global)crypto map map-name sequence ipsec-isakmp dynamic dyn-map-name [discover]
(global)crypto map map-name client configuration address [initiate | respond]
(global)crypto map map-name isakmp authorization list list-name
(interface)crypto map map-name
(global)crypto map map-name local-address interface-id