ip crypto-group

Last Updated : Aug 28, 2026 |
Activates a crypto-list in the context of the interface on which the crypto-list is activated. Use no ip crypto-group to deactivate a crypto-list.
Prolog information
Metadata
Keywords:
The command applies to the following interfaces:
  • FastEthernet
  • Dialer
Note:
This command applies also to the VLAN interface, but this option is not recommended.
Most IPSec VPN parameters cannot be modified if they are linked to an active crypto-list. To modify a parameter linked to an active crypto-list, you must first deactivate the list using the no ip crypto-group command in the context of the interface on which the crypto-list is activated.

Syntax

[no] ip crypto-group crypto-list-id

Parameters

Parameter
Description
Possible Values
Default Value
crypto_list_id
The crypto-list number
901-999

User level

read-write

Context

interface:FastEthernet (L2, L2-L3, PPP L2, PPP L2-L3, PPP L3), Dialer (L2, L2-L3), VLAN (L2, L2-L3)

Example

To activate crypto-list 901:
Gxxx-001(if:fastEthernet 10/2)# ip crypto-group 901