Cisco IOS Security Command Reference

Security Commands
January 2008
Cisco IOS Security Command Reference
crypto map local-address
However, if you use a local-address for that crypto map set, it has multiple effects:
Only one IPSec security association database will be established and shared for traffic through both
interfaces.
The IP address of the specified interface will be used as the local address for IPSec (and IKE) traffic
originating from or destined to that interface.
One suggestion is to use a loopback interface as the referenced local address interface, because the
loopback interface never goes down.
Examples The following example assigns crypto map set “mymap” to the S0 interface and to the S1 interface.
When traffic passes through either S0 or S1, the traffic will be evaluated against the all the crypto maps
in the “mymap” set. When traffic through either interface matches an access list in one of the “mymap”
crypto maps, a security association will be established. This same security association will then apply to
both S0 and S1 traffic that matches the originally matched IPSec access list. The local address that IPSec
will use on both interfaces will be the IP address of interface loopback0.
interface S0
crypto map mymap
interface S1
crypto map mymap
crypto map mymap local-address loopback0
Related Commands Command Description
crypto map (interface IPSec) Applies a previously defined crypto map set to an
interface.
SEC-565