Corporate Headquarters

•
The crypto map entries must each identify the other peer (unless the responding peer is using 
dynamic crypto maps).
•
The crypto map entries must have at least one transform set in common.
When IKE is used to establish SAs, the IPSec peers can negotiate the settings they will use for the new 
SAs. This means that you can specify lists (such as lists of acceptable transforms) within the crypto map 
entry. 
After you have completed configuring IPSec at each participating IPSec peer, configure crypto map 
entries and apply the crypto maps to interfaces. 
The task of configuring IPSec at each peer can be eased by utilizing dynamic crypto maps. By 
configuring the head-end Cisco 7200 series router with a dynamic map, and the peers with a static map, 
the peer will be permitted to establish an IPSec security association even though 
th
e router does not have 
a crypto map entry specifically configured to meet all of the remote peer requirements.
This section contains basic steps to configure crypto maps and includes the following tasks:

---

3-25
Cisco IOS VPN Configuration Guide
OL-8336-01
Chapter 3 Site-to-Site and Extranet VPN Business Scenarios
Step 3—Configuring Encryption and IPSec
•
Creating Crypto Map Entries
•
Verifying Crypto Map Entries
•
Applying Crypto Maps to Interfaces
•
Verifying Crypto Map Interface Associations
Creating Crypto Map Entries
To create crypto map entries that will use IKE to establish the SAs, complete the following steps starting 
in global configuration mode:
To create dynamic crypto map entries that will use IKE to establish the SAs, complete the following 
steps, starting in global configuration mode: