09.12.2012 Views

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

connects, <strong>the</strong> active key information will be displayed on both routers'consoles.<br />

After you both verify that <strong>the</strong> same key information is being displayed, passive will<br />

agree <strong>to</strong> accept active's key. The process <strong>the</strong>n repeats itself for active <strong>to</strong> accept<br />

passive's key. To configure <strong>the</strong> router <strong>to</strong> be <strong>the</strong> passive DES key exchange partner,<br />

use <strong>the</strong> global configuration command . To enable an active exchange, use <strong>the</strong> command . Both <strong>the</strong> active and<br />

passive routers need <strong>to</strong> use <strong>the</strong> same TCP port number. Here are examples of <strong>the</strong><br />

passive and active key exchange commands used on routers hobo (passive) and bum<br />

(active):<br />

hobo(config)#cryp<strong>to</strong> key-exchange passive 8080<br />

bum(config)#cryp<strong>to</strong> key-exchange 172.16.44.5 8080<br />

Now let's create and apply our cryp<strong>to</strong> maps. The cryp<strong>to</strong> map uses an extended ACL<br />

<strong>to</strong> match traffic. Because we are encrypting GRE traffic only, our ACL looks like this<br />

(we are using <strong>the</strong> 172.16.0.0 /16 for all private <strong>network</strong> traffic):<br />

bum(config)#access-list 100 permit gre 172.16.0.0 0.0.255.255 72.16.0.0<br />

0.0.255.255<br />

A cryp<strong>to</strong> map is configured <strong>the</strong> same way as a route-map. The cryp<strong>to</strong> map is<br />

created globally . The map name is used <strong>to</strong> associate <strong>the</strong><br />

map with an interface, using <strong>the</strong> interface subcommand .<br />

The following example creates <strong>the</strong> cryp<strong>to</strong> map on <strong>the</strong> router bum, using <strong>the</strong> ACL<br />

created above, and applies it <strong>to</strong> <strong>the</strong> tunnel and <strong>the</strong> tunnel source interface:<br />

bum(config)#cryp<strong>to</strong> map vpn 10<br />

bum(config-cryp<strong>to</strong>-map)#set peer hobo<br />

bum(config-cryp<strong>to</strong>-map)#match address 100<br />

bum(config-cryp<strong>to</strong>-map)#set algorithm 40-bit-des<br />

bum(config-cryp<strong>to</strong>-map)#exit<br />

bum(config)#interface tunnel 100<br />

bum(config-if)#cryp<strong>to</strong> map vpn<br />

bum(config-if)#exit<br />

bum(config) interface serial0<br />

bum(config-if)#cryp<strong>to</strong> map vpn

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!