Corporate Headquarters

•
Creating Crypto Access Lists
•
Verifying Crypto Access Lists
•
Defining Transform Sets and Configuring IPSec Tunnel Mode
•
Verifying Transform Sets and IPSec Tunnel Mode
Note
IKE uses User Datagram Protocol (UDP) port 500. The IPSec encapsulating security payload (ESP) and 
authentication header (AH) protocols use IP protocol numbers 50 and 51. Ensure that your access lists 
are configured so that IP protocol 50, 51, and UDP port 500 traffic is not blocked at interfaces used by 
IPSec. In some cases, you might need to add a statement to your access lists to explicitly permit this 
traffic. Crypto access lists use the same format as standard access lists. However, the 
permit
command 
instructs the router to encrypt data, and the 
deny
command instructs the router to allow unencrypted 
data.
Creating Crypto Access Lists
Crypto access lists are used to define which IP traffic will be protected by crypto and which traffic will 
not be protected by crypto. (These access lists are 
not
the same as regular access lists, which determine 
what traffic to forward or block at an interface.) For example, you can create access lists to protect all 
IP traffic between the headquarters router and business partner router.
The access lists themselves are not specific to IPSec. It is the crypto map entry referencing the specific 
access list that defines whether IPSec processing is applied to the traffic matching a 
permit
in the access 
list.
To create a crypto access list, enter the following command in global configuration mode:
Verifying Crypto Access Lists
To verify the configuration:
•
Enter the 
show access-lists 111 
EXEC command to see the access list attributes.
hq-sanjose#