Note
This command is now deprecated. It will be removed in a future release.
Description
Configures IPSec cryptographic settings.
Use the no form of this command to clear the settings.
Syntax
crypto ipsec {ike | peer}
crypto ipsec ike [clear sa {peer {IPv4 address or IPv6 address | any localIPv4 address or IPv6 address}} | restart]
crypto ipsec peerpaddresslocalladdresskeying {ike | manual}
crypto ipsec peerpaddresslocalladdresskeying manual {<cr> | auth | encrypt | local-spi | mode | remote-spi}
crypto ipsec peerpaddresslocalladdresskeying ike auth {hmac-md5 | hmac-sha1 | null}
crypto ipsec peerpaddresslocalladdresskeying ike encrypt {3des-cbc | aes-cbc | null}
crypto ipsec peerpaddresslocalladdresskeying ike exchange-mode {main | aggressive | base}
crypto ipsec peer paddresslocalladdresskeying ike lifetimeseconds
crypto ipsec peerpaddresslocalladdresskeying ike mode {transport | tunnel}
crypto ipsec peer paddresslocalladdresskeying ike pfs-groupgname
crypto ipsec peerpaddresslocalladdresskeying ike preshared-keykname
crypto ipsec peerpaddresslocalladdresskeying ike prompt-preshared-key
crypto ipsec peerpaddresslocalladdressenable
[no] crypto ipsec peerpaddresslocalladdress
User role
Admin.
Parameters
ike
Manages the IKE (ISAKMP) process or database state.
clear sa—Clears IKE-generated ISAKMP and IPsec security associations (peers may be affected).
peer IPv4 address or IPv6 address—Clears security associations for the specified IKE peer (remote peers are affected).
any local IPv4 address or IPv6 address—Clears security associations for all IKE peerings with a specific local address (remote peers are affected).
restart—Restarts the IKE (ISAKMP) daemon (clears all IKE state; peers may be affected).
peer paddress
Configures an IPv4 or IPv6 IPsec cryptographic peer IP address.
local laddress
Local IP address.
manual
Configures IPsec using manual keys via the following options:
auth—Configures the authentication algorithm for this IPsec peering.
crypto ipsec peer paddress local laddress keying manual auth {hmac-md5 | hmac-sha1 | null}
hmac-md5 authentication, hmac-sha1 authentication, or null (encryption without authentication).
encrypt—Configures the encryption algorithm for this IPsec peering.
crypto ipsec peer paddress local laddress keying manual encrypt {3des-cbc | aes-cbc | null}
3des-cbc encryption, aes-cbc encryption, or null (uses null encryption per RFC 2410).
local-spi—Configures the local SPI for this manual IPsec peering.
mode—Configures the peering mode for this IPsec peering.
remote-spi—Configures the remote SPI for this manual IPsec peering.
auth {hmac-md5 | hmac-sha1}
Authentication algorithm.
encrypt {3des-cbc | aes-cbc | null}
Encryption algorithms. With the null option, encryption per RFC 2410 is still used for proposal.
exchange-mode {main | aggressive | base}
Internet Key Exchange (IKE) exchange mode for the IPsec peer (main, aggressive, or base).
lifetime seconds
Duration (seconds) of an IKE group for the IPsec peer.
mode {transport | tunnel}
Type of IPsec connection (tunnel or transport).
pfs-group gname
Name of the perfect forward secrecy (PFS) group for the IPsec peer.
preshared-key kname
Preshared key for authenticating the IPsec peer.
prompt-preshared-key
Indication that the system should prompt for the preshared key. The system prompts for the key when you press ENTER.
enable
Enables this IPSec peering.
Example
The following example assigns the main IKE exchange mode for the IPsec peer.
hostname (config) # crypto ipsec peer 192.168.5.4 local 192.168.4.3 exchange-mode main