Corporate Headquarters

Command
Purpose
Step 1
hq-sanjose(config)#
crypto ipsec transform-set 
proposal4 ah-sha-hmac esp-des
Define a transform set and enter crypto-transform 
configuration mode. This example combines AH
1
transform ah-sha-hmac, ESP
2
encryption transform 
esp-des, and ESP authentication transform esp-sha-hmac 
in the transform set proposal4.
There are complex rules defining which entries you can 
use for the transform arguments. These rules are 
explained in the command description for the 
crypto 
ipsec transform-set
command. You can also use the 
crypto ipsec transform-set? 
command, in global 
configuration mode, to view the available transform 
arguments.
1.
AH = authentication header. This header, when added to an IP datagram, ensures the integrity and authenticity of the data, including the 
invariant fields in the outer IP header. It does not provide confidentiality protection. AH uses a keyed-hash function rather than digital 
signatures.
2.
ESP = encapsulating security payload. This header, when added to an IP datagram, protects the confidentiality, integrity, and authenticity of 
the data. If ESP is used to validate data integrity, it does not include the invariant fields in the IP header.
Step 2
hq-sanjose(cfg-crypto-trans)#
mode tunnel
Change the mode associated with the transform set. The 
mode setting is only applicable to traffic whose source 
and destination addresses are the IPSec peer addresses; it 
is ignored for all other traffic. (All other traffic is in tunnel 
mode only.) This example configures tunnel mode for the 
transport set proposal4, which creates an IPSec tunnel 
between the IPSec peer addresses.
Step 3
hq-sanjose(cfg-crypto-trans)#