Corporate Headquarters

Command
Purpose
Step 1
hq-sanjose(config)#
crypto map s4second 
local-address serial 2/0
Create the crypto map and specify a local address 
(physical interface) to be used for the IPSec traffic. This 
example creates crypto map s4second and specifies serial 
interface 2/0 of the headquarters router as the local 
address. This step is only required if you have previously 
used the 
loopback
command or if you are using GRE 
tunnels.
Step 2
hq-sanjose(config)#
crypto map s4second 2 
ipsec-isakmp
Enter crypto map configuration mode, specify a sequence 
number for the crypto map you created in Step 1, and 
configure the crypto map to use IKE to establish SAs. 
This example configures sequence number 2 and IKE for 
crypto map s4second.
Step 3
hq-sanjose(config-crypto-map)#
match address 111
Specify an extended access list. This access list 
determines which traffic is protected by IPSec and which 
traffic is not be protected by IPSec. This example 
configures access list 111, which was created in the 
“Creating Crypto Access Lists” section on page 3-22
.
Step 4
hq-sanjose(config-crypto-map)#
set peer 
172.23.2.7
Specify a remote IPSec peer (by host name or IP address). 
This is the peer to which IPSec protected traffic can be 
forwarded. This example specifies serial interface 1/0 
(172.23.2.7) on the business partner router.
Step 5
hq-sanjose(config-crypto-map)#
set transform-set 
proposal4
Specify which transform sets are allowed for this crypto 
map entry. List multiple transform sets in order of priority 
(highest priority first). This example specifies transform 
set proposal4, which was configured in the 
“Defining 
Transform Sets and Configuring IPSec Tunnel Mode” 
section on page 3-23
.