> # About Transform Sets in IPsec

> A transform set represents a certain combination of security protocols and algorithms. During the IPsec security association negotiation, the peers agree to use a particular transform set for protecting a particular data flow.

> You can specify multiple transform sets, and then specify one or more of these transform sets in a crypto map entry. The transform set defined in the crypto map entry is used in the IPsec security association negotiation to protect the data flows specified by that crypto map entry's access list.

> During IPsec security association negotiations with IKE, the peers search for a transform set that is the same at both peers. When such a transform set is found, it is selected and applied to the protected traffic as part of both peers' IPsec security associations.

> Tip If you change a transform set definition, the change is only applied to crypto map entries that reference the transform set. The change is not applied to existing security associations, but used in subsequent negotiations to establish new security associations. If you want the new settings to take effect sooner, you can clear all or part of the security association database.

> Note When you enable IPsec, the Cisco NX-OS software automatically creates a default transform set (ipsec_default_tranform_set) using AES-128 encryption and SHA-1 authentication algorithms.

> Table 36-2 provides a list of allowed transform combinations for IPsec.

> Table 36-2 IPsec Transform Configuration Parameters
> Parameter | Accepted Values | Keyword
> --- | --- | ---
> encryption algorithm | 56-bit DES-CBC 168-bit DES 128-bit AES-CBC 128-bit AES-CTR1 256-bit AES-CBC 256-bit AES-CTR1 | esp-des esp-3des esp-aes 128 esp-aes 128 ctr esp-aes 256 esp-aes 256 ctr
> hash/authentication algorithm1 (optional) | SHA-1 (HMAC variant) MD5 (HMAC variant) AES-XCBC-MAC | esp-sha1-hmac esp-md5-hmac esp-aes-xcbc-mac

> 1If you configure the AES counter (CTR) mode, you must also configure the authentication algorithm.

> The following table lists the supported and verified settings for IPsec and IKE encryption authentication algorithms on the Microsoft Windows and Linux platforms:

> Platform | IKE | IPsec
> --- | --- | ---
> Microsoft iSCSI initiator, Microsoft IPsec implementation on Microsoft Windows 2000 platform | 3DES, SHA-1 or MD5, DH group 2 | 3DES, SHA-1
> Cisco iSCSI initiator, Free Swan IPsec implementation on Linux platform | 3DES, MD5, DH group 1 | 3DES, MD5

> Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.