Assigning a crypto list to an interface

Last Updated : Apr 10, 2018 |
Prolog information
Metadata
Keywords:
A crypto list is activated on an interface. You can assign multiple crypto lists to different interfaces on the Branch Gateway.
  1. Enter interface context using the interface command.
    For example:
    Gxxx-001# interface fastethernet 10/3
    Gxxx-001(config-if:FastEthernet 10/3)#
  2. Configure the IP address of the interface.
    ADDITIONAL INFORMATION:
    You can configure either a static or a dynamic IP address.
    • To configure a static IP address:
      • Be sure to specify an IP address (not an interface name) as the local-address in the crypto list (see Configuring crypto lists)
      • Within the interface context, specify the IP address and mask using the ip address command
        For example:
        Gxxx-001(config-if:FastEthernet 10/3)# ip address 192.168.49.1 25.255.255.0
    • To configure a dynamic IP address, see Dynamic local peer IP
  3. Use the ip crypto-group command, followed by the index of the crypto-group, to assign a crypto-group to the interface.
    ADDITIONAL INFORMATION:
    Important:
    ip crypto-group is a mandatory command.
  4. Optionally, you can set the following parameters:
    • The crypto ipsec minimal-pmtu command is intended for advanced users only. It sets the minimal PMTU value which can be applied to an SA when the Branch Gateway participates in Path MTU Discovery (PMTUD) for the tunnel pertaining to that SA.
    • The crypto ipsec df-bit command is intended for advanced users only. It sets the Do Not Fragment (DF) bit to either clear or copy mode:
    For example:
    Gxxx-001(config-if:FastEthernet 10/3)# ip crypto-group 901
    Done!
    Gxxx-001(config-if:FastEthernet 10/3)# crypto ipsec minimal pmtu 500
    Done!
    Gxxx-001(config-if:FastEthernet 10/3)# crypto ipsec df-bit copy
    Done!
  5. Exit the interface context with the exit command.
    For example:
    Gxxx-001(config-if:FastEthernet 10/3)# exit
    Gxxx-001#
Related links
Site-to-site IPSec VPN