|
|
This chapter describes the function and displays the syntax for network data encryption commands. For more information about defaults and usage guidelines, see the corresponding chapter of the Security Command Reference.
To define an encryption access list by number, use the extended IP access-list global configuration command. To remove a numbered encryption access list, use the no form of this command.
access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}| access-list-number | Number of an encryption access list. This is a decimal number from 100 to 199. |
| dynamic dynamic-name | (Optional) Identifies this encryption access list as a dynamic encryption access list. Refer to lock-and-key access documented in the "Configuring Lock-and-Key Security (Dynamic Access Lists)" chapter in the Security Configuration Guide. |
| timeout minutes | (Optional) Specifies the absolute length of time (in minutes) that a temporary access list entry can remain in a dynamic access list. The default is an infinite length of time and allows an entry to remain permanently. Refer to lock-and-key access documented in the "Configuring Lock-and-Key Security (Dynamic Access Lists)" chapter in the Security Configuration Guide. |
| deny | Does not encrypt/decrypt IP traffic if the conditions are matched. |
| permit | Encrypts/decrypts IP traffic if the conditions are matched. |
| protocol | Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol, including ICMP, TCP, and UDP, use the keyword ip. Some protocols allow further qualifiers, as described in text that follows. |
| source | Number of the network or host from which the packet is being sent. There are three other ways to specify the source:
|
|
source-wildcard | Wildcard bits (mask) to be applied to source. There are three other ways to specify the source wildcard:
|
|
destination | Number of the network or host to which the packet is being sent. There are three other ways to specify the destination:
|
|
destination-wildcard | Wildcard bits to be applied to the destination. There are three other ways to specify the destination wildcard:
|
|
precedence precedence | (Optional) Packets can be matched for encryption by precedence level, as specified by a number from 0 to 7 or by name. |
| tos tos | (Optional) Packets can be matched for encryption by type of service level, as specified by a number from 0 to 15 or by name. |
| icmp-type | (Optional) ICMP packets can be matched for encryption by ICMP message type. The type is a number from 0 to 255. |
| icmp-code | (Optional) ICMP packets that are matched for encryption by ICMP message type can also be matched by the ICMP message code. The code is a number from 0 to 255. |
| icmp-message | (Optional) ICMP packets can be matched for encryption by an ICMP message type name or ICMP message type and code name. |
| igmp-type | (Optional) IGMP packets can be matched for encryption by IGMP message type or message name. A message type is a number from 0 to 15. |
| operator | (Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).
If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number. |
| port | (Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535.
TCP port names can be used only when filtering TCP. UDP port names can be used only when filtering UDP. |
| established | (Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection. |
| log | (Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)
The message includes the access list number, whether the packet was encrypted/decrypted or not; the protocol, whether it was TCP, UDP, ICMP, or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets encrypted/decrypted or not in the prior 5-minute interval. |
To terminate an encrypted session in progress, use the clear crypto connection global configuration command.
clear crypto connection connection-id| connection-id | Identifies the encrypted session to terminate. |
To globally enable 40-bit Data Encryption Standard (DES) algorithm types, use the crypto algorithm 40-bit-des global configuration command. Use the no form of this command to globally disable a 40-bit DES algorithm type.
crypto algorithm 40-bit-des [cfb-8 | cfb-64]| cfb-8 | (Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the 40-bit DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default. |
| cfb-64 | (Optional) Selects the 64-bit CFB mode of the 40-bit DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default. |
To globally enable Data Encryption Standard (DES) algorithm types that use a 56-bit DES key, use the crypto algorithm des global configuration command. Use the no form of this command to globally disable a DES algorithm type.
crypto algorithm des [cfb-8 | cfb-64]| cfb-8 | (Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the basic DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default. |
| cfb-64 | (Optional) Selects the 64-bit CFB mode of the basic DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default. |
To reset an Encryption Service Adapter (ESA), use the crypto clear-latch global configuration command. This command resets the ESA by clearing a hardware extraction latch that is set when an ESA is removed and reinstalled in the chassis.
crypto clear-latch slot| slot | Identifies the ESA to reset. On a Cisco 7200 series router, this is the ESA chassis slot number. On a Cisco RSP7000 or 7500 series router, this is the chassis slot number of the ESA's second-generation Versatile Interface Processor (VIP2). |
To enable (select) either the ESA crypto engine or the Cisco IOS crypto engine in Cisco 7200 series routers, use the crypto esa global configuration command.
crypto esa {enable | shutdown} slot| enable | Selects the ESA crypto engine by enabling the ESA. |
| shutdown | Selects the Cisco IOS crypto engine by shutting down the ESA. |
| slot | The ESA chassis slot number. |
To generate a Digital Signature Standard (DSS) public/private key pair, use the crypto gen-signature-keys global configuration command.
crypto gen-signature-keys key-name [slot]| key-name | A name you assign to the crypto engine. This will name either the Cisco IOS software crypto engine, a second-generation Versatile Interface Processor (VIP2) crypto engine, or an Encryption Service Adapter (ESA) crypto engine. Any character string is valid. Using a fully qualified domain name might make it easier to identify public keys. |
| slot | (Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.
If no slot is specified, the Cisco IOS crypto engine will be selected. Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500). |
To exchange Digital Signature Standard (DSS) public keys, the administrator of the peer encrypting router that is designated ACTIVE must use the crypto key-exchange global configuration command.
crypto key-exchange ip-address key-name [tcp-port]| ip-address | The IP address of the peer router (designated PASSIVE) participating with you in the key exchange. |
| key-name | Identifies the crypto engine--either the Cisco IOS crypto engine, a second-generation Versatile Interface Processor (VIP2) crypto engine, or an Encryption Service Adapter (ESA) crypto engine. This name must match the key-name argument assigned when you generated DSS keys using the crypto gen-signature-keys command. |
| tcp-port | (Optional) Cisco IOS software uses the unassigned1 TCP port number of 1964 to designate a key exchange. You may use this optional keyword to select a different number to designate a key exchange, if your system already uses the port number 1964 for a different purpose. If this keyword is used, you must use the same value as the PASSIVE router's tcp-port value. |
To enable an exchange of Digital Signature Standard (DSS) public keys, the administrator of the peer encrypting router that is designated PASSIVE must use the crypto key-exchange passive global configuration command.
crypto key-exchange passive [tcp-port]| tcp-port | (Optional) Cisco IOS software uses the unassigned1 TCP port number of 1964 to designate a key exchange. You may use this optional keyword to select a different number to designate a key exchange, if your system already uses the port number 1964 for a different purpose. If this keyword is used, you must use the same value as the ACTIVE router's tcp-port value. |
To specify the time duration of encrypted sessions, use the crypto key-timeout global configuration command. Use the no form to restore the time duration of encrypted sessions to the default of 30 minutes.
crypto key-timeout minutes| minutes | Specifies the time duration of encrypted sessions. Can be from 1 to 1440 minutes (24 hours) in 1 minute increments. Specified by an integer from 1 to 1440.
When the no form of the command is used, this argument is optional. Any value supplied for the argument is ignored by the router. |
To create or modify a crypto map definition and enter the crypto map configuration mode, use the crypto map global configuration command. Use the no form of this command to delete a crypto map definition.
crypto map map-name seq-num| map-name | The name you assign to the crypto map. |
| seq-num | Identifies the sequence number (definition set) of the crypto map. |
To apply a previously defined crypto map to an interface, use the crypto map interface configuration command. Use the no form of the command to eliminate the crypto map from the interface.
crypto map map-name| map-name | The name which identifies the crypto map. This is the name you assigned when creating the crypto map.
When the no form of the command is used, this argument is optional. Any value supplied for the argument is ignored by the router. |
To enable pregeneration of Diffie-Hellman (DH) public numbers, use the crypto pregen-dh-pairs global configuration command. Use the no form to disable pregeneration of DH public numbers for all crypto engines.
crypto pregen-dh-pairs count [slot]| count | Specifies how many DH public numbers to pregenerate and hold in reserve. Specified by an integer from 0 to 10. |
| slot | (Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.
If no slot is specified, the Cisco IOS crypto engine will be selected. Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500). |
To manually specify the Digital Signature Standard (DSS) public key of a peer encrypting router, use the crypto public-key global configuration command. Use the no form of this command to delete the DSS public key of a peer encrypting router.
crypto public key key-name serial-number| key-name | Identifies the crypto engine of the peer encrypting router. |
| serial-number | The serial number of the peer encrypting router's public DSS key.
When the no form of the command is used, this argument is optional. Any value supplied for the argument is ignored by the router. |
| hex-key-data | The DSS public key of the peer encrypting router, in hexadecimal format. |
| quit | When you are done entering the public key, type quit to exit the hex input mode. |
To change the maximum number of destinations (hosts or subnets) per source that you can define in encryption access list statements, use the crypto sdu connections global configuration command. Use the no form of the command to restore the default.
crypto sdu connections number| number | Specifies the maximum number of destinations per source. Use a value from 3 to 500.
This argument is not required when using the no form of the command. |
To change the maximum number of sources (hosts or subnets) that you can define in encryption access list statements, use the crypto sdu entities global configuration command. Use the no form of the command to restore the default.
crypto sdu entities number| number | Specifies the maximum number of sources. Use a value from 3 to 500.
This argument is not required when using the no form of the command. |
To delete the Digital Signature Standard (DSS) public/private key pair of a crypto engine, use the crypto zeroize global configuration command.
crypto zeroize [slot]| slot | (Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.
If no slot is specified, the Cisco IOS crypto engine will be selected. Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500). |
To set conditions for a named encryption access list, use the deny access-list configuration command. The deny command prevents IP traffic from being encrypted/decrypted if the conditions are matched. To remove a deny condition from an encryption access list, use the no form of this command.
deny source [source-wildcard]| source | Number of the network or host from which the packet is being sent. There are two alternative ways to specify the source:
|
|
source-wildcard | (Optional) Wildcard bits to be applied to the source. There are two alternative ways to specify the source wildcard:
|
|
protocol | Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 through 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip. Some protocols allow further qualifiers described later. |
| source | Number of the network or host from which the packet is being sent. There are three alternative ways to specify the source:
|
|
source-wildcard | Wildcard bits to be applied to source. There are three alternative ways to specify the source wildcard:
|
|
destination | Number of the network or host to which the packet is being sent. There are three alternative ways to specify the destination:
|
|
destination-wildcard | Wildcard bits to be applied to the destination. There are three alternative ways to specify the destination wildcard:
|
|
precedence precedence | (Optional) Packets can be matched for encryption by precedence level, as specified by a number from 0 to 7 or by name. |
| tos tos | (Optional) Packets can be matched for encryption by type of service level, as specified by a number from 0 to 15 or by name. |
| icmp-type | (Optional) ICMP packets can be matched for encryption by ICMP message type. The type is a number from 0 to 255. |
| icmp-code | (Optional) ICMP packets which are matched for encryption by ICMP message type can also be matched by the ICMP message code. The code is a number from 0 to 255. |
| icmp-message | (Optional) ICMP packets can be matched for encryption by an ICMP message type name or ICMP message type and code name. |
| igmp-type | (Optional) IGMP packets can be matched for encryption by IGMP message type or message name. A message type is a number from 0 to 15. |
| operator | (Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).
If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number. |
| port | (Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65,535. TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP. |
| established | (Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection. |
| log | (Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)
The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval. |
To define an encryption access list by name, use the ip access-list extended global configuration command. To remove a named encryption access list, use the no form of this command.
ip access-list extended name| name | Name of the encryption access list. Names cannot contain a space or quotation mark, and must begin with an alphabetic character to prevent ambiguity with numbered access lists. |
To specify an encryption access list within a crypto map definition, use the match address crypto map configuration command. Use the no form of this command to eliminate an encryption access list from a crypto map definition.
match address [access-list-number | name]| access-list-number | Identifies the numbered encryption access list. This value should match the access-list-number argument of the numbered encryption access list being matched. |
| name | Identifies the named encryption access list. This name should match the name argument of the named encryption access list being matched. |
To set conditions for a named encryption access list, use the permit access-list configuration command. The permit command causes IP traffic to be encrypted/decrypted if the conditions are matched. To remove a permit condition from an encryption access list, use the no form of this command.
permit source [source-wildcard]| source | Number of the network or host from which the packet is being sent. There are two alternative ways to specify the source:
|
|
source-wildcard | (Optional) Wildcard bits to be applied to the source. There are two alternative ways to specify the source wildcard:
|
|
protocol | Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 through 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip. Some protocols allow further qualifiers described later. |
| source | Number of the network or host from which the packet is being sent. There are three alternative ways to specify the source:
|
|
source-wildcard | Wildcard bits to be applied to source. There are three alternative ways to specify the source wildcard:
|
|
destination | Number of the network or host to which the packet is being sent. There are three alternative ways to specify the destination:
|
|
destination-wildcard | Wildcard bits to be applied to the destination. There are three alternative ways to specify the destination wildcard:
|
|
precedence precedence | (Optional) Packets can be matched for encryption by precedence level, as specified by a number from 0 to 7 or by name. |
| tos tos | (Optional) Packets can be matched for encryption by type of service level, as specified by a number from 0 to 15 or by name. |
| icmp-type | (Optional) ICMP packets can be matched for encryption by ICMP message type. The type is a number from 0 to 255. |
| icmp-code | (Optional) ICMP packets which are matched for encryption by ICMP message type can also be matched by the ICMP message code. The code is a number from 0 to 255. |
| icmp-message | (Optional) ICMP packets can be matched for encryption by an ICMP message type name or ICMP message type and code name. |
| igmp-type | (Optional) IGMP packets can be matched for encryption by IGMP message type or message name. A message type is a number from 0 to 15. |
| operator | (Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).
If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number. |
| port | (Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535. TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP. |
| established | (Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection. |
| log | (Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)
The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval. |
To specify a 40-bit Data Encryption Standard (DES) algorithm type within a crypto map definition, use the set algorithm 40-bit-des crypto map configuration command. Use the no form of this command to disable a 40-bit DES algorithm type within a crypto map definition.
set algorithm 40-bit-des [cfb-8 | cfb-64]| cfb-8 | (Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the 40-bit DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default. |
| cfb-64 | Selects the 64-bit CFB mode of the 40-bit DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default. |
To enable basic Data Encryption Standard (DES) algorithm types within a crypto map definition, use the set algorithm des crypto map configuration command. Use the no form of this command to disable a basic DES algorithm type within a crypto map definition.
set algorithm des [cfb-8 | cfb-64]| cfb-8 | (Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the basic DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default. |
| cfb-64 | (Optional) Selects the 64-bit CFB mode of the basic DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default. |
To specify a peer encrypting router within a crypto map definition, use the set peer crypto map configuration command. Use the no form of this command to eliminate a peer encrypting router from a crypto map definition.
set peer key-name| key-name | Identifies the crypto engine of the peer encrypting router. |
To view which Data Encryption Standard (DES) algorithm types are globally enabled for your router, use the show crypto algorithms privileged EXEC command. This displays all basic DES and 40-bit DES algorithm types globally enabled.
show crypto algorithmsTo view the operational status of an Encryption Service Adapter (ESA), use the show crypto card privileged EXEC command. This command is available only on Cisco 7200, RSP7000, or 7500 series routers with an installed ESA.
show crypto card [slot]| slot | This argument is used only on Cisco RSP7000 and 7200 series routers.
Identifies the ESA to show. Use the chassis slot number of the VIP2 containing the ESA. |
To view current and pending encrypted session connections, use the show crypto connections privileged EXEC command.
show crypto connectionsTo view all crypto engines within a Cisco 7200, RSP7000, or 7500 series router, use the show crypto engine brief privileged EXEC command.
show crypto engine briefTo view the Cisco IOS crypto engine of your router, use the show crypto engine configuration privileged EXEC command.
show crypto engine configurationTo view the current active encrypted session connections for all crypto engines, use the show crypto engine connections active privileged EXEC command.
show crypto engine connections active [slot]| slot | (Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.
If no slot is specified, the Cisco IOS crypto engine will be selected. Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500). |
To view information about packets dropped during encrypted sessions for all router crypto engines, use the show crypto engine connections dropped-packets privileged EXEC command.
show crypto engine connections dropped-packetsTo view the current setting for the time duration of encrypted sessions, use the show crypto key-timeout privileged EXEC command.
show crypto key-timeoutTo view all created crypto maps of your router, use the show crypto map privileged EXEC command.
show crypto mapTo view the crypto map applied to a specific interface, use the show crypto map interface privileged EXEC command.
show crypto map interface interface
| interface | Designates the router interface. |
To view a specific crypto map, use the show crypto map tag privileged EXEC command.
show crypto map tag map-name| map-name | Identifies the crypto map by its name. This should match the map-name argument assigned during crypto map creation. |
To view Digital Signature Standard (DSS) public keys (for all your router crypto engines) in hexadecimal form, use the show crypto mypubkey EXEC command.
show crypto mypubkey [rsp]| rsp | (Optional) This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.
If this argument is used, only the DSS public keys for the Route Switch Processor (RSP) (Cisco IOS crypto engine) will be displayed. If this argument is not used, DSS public keys for all crypto engines will be displayed. |
To view the number of Diffie-Hellman (DH) number pairs currently generated, use the show crypto pregen-dh-pairs privileged EXEC command.
show crypto pregen-dh-pairs [slot]| slot | (Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.
If no slot is specified, the Cisco IOS crypto engine will be selected. Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500). |
To view all peer router Digital Signature Standard (DSS) public keys known to your router, use the show crypto pubkey EXEC command.
show crypto pubkeyTo view a specific peer router Digital Signature Standard (DSS) public key known by its name, use the show crypto pubkey name EXEC command.
show crypto pubkey name key-name| key-name | Identifies the crypto engine of the peer router. |
To view a specific peer router Digital Signature Standard (DSS) public key known by its serial number, use the show crypto pubkey serial EXEC command.
show crypto pubkey serial serial-number| serial-number | Identifies the serial number of the crypto engine. |
To set up a test encryption session, use the test crypto initiate-session privileged EXEC command.
test crypto initiate-session src-ip-addr dst-ip-addr map-name seq-num| src-ip-addr | IP address of source host. Should be included in an encryption access list definition as a valid IP address source address. |
| dst-ip-addr | IP address of destination host. Should be included in an encryption access list definition as a valid IP address destination address. |
| map-name | Names the crypto map to be used. |
| seq-num | Names the crypto map sequence number. |
|
|