> # Crypto Map Configuration Guidelines

> When configuring crypto map entries, follow these guidelines:

> - The sequence number for each crypto map decides the order in which the policies are applied. A lower sequence number is assigned a higher priority.
> - Only one IPv4-ACL is allowed for each crypto map entry (the IPv4-ACL itself can have multiple permit or deny entries).
> - When the tunnel endpoint is the same as the destination address, you can use the auto-peer option to dynamically configure the peer.
> - For IPsec to interoperate effectively with Microsoft iSCSI initiators, specify the TCP protocol and the local iSCSI TCP port number (default 3260) in the IPv4-ACL. This configuration ensures the speedy recovery of encrypted iSCSI sessions following disruptions such as Gigabit Ethernet interfaces shutdowns, VRRP switchovers, and port failures.

> Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.