Corporate Headquarters

show access-lists 111
Extended IP access list 111
permit ip host 10.2.2.2 host 10.1.5.3
Command
Purpose
hq-sanjose(config)#
access-list 111 permit 
ip host 10.2.2.2 host 10.1.5.3
Specify conditions to determine which IP packets are protected.
1
(Enable 
or disable crypto for traffic that matches these conditions.) This example 
configures access list 111 to encrypt all IP traffic between the 
headquarters server (translated inside global IP address 10.2.2.2) and 
PC B (IP address 10.1.5.3) in the business partner office. 
We recommend that you configure “mirror image” crypto access lists for 
use by IPSec and that you avoid using the 
any
keyword.
1.
You specify conditions using an IP access list designated by either a number or a name. The 
access-list
command designates a numbered extended access 
list; the 
ip access-list extended
command designates a named access list.

---

3-23
Cisco IOS VPN Configuration Guide
OL-8336-01
Chapter 3 Site-to-Site and Extranet VPN Business Scenarios
Step 3—Configuring Encryption and IPSec
Tip
If you have trouble, make sure you are specifying the correct access list number.
Defining Transform Sets and Configuring IPSec Tunnel Mode
You must define transform sets regardless of the tunneling protocol you use. To define a transform set 
and configure IPSec tunnel mode, complete the following steps starting in global configuration mode:
Note
AH and ESP can be used independently or together, although for most applications just one of them is 
sufficient. For both of these protocols, IPSec does not define the specific security algorithms to use, but 
rather, provides an open framework for implementing industry-standard algorithms.