> # About Crypto IPv4-ACLs

> IP access control lists (IPv4-ACLs) provide basic network security to all switches in the Cisco MDS 9000 Family. IPv4 IP-ACLs restrict IP-related traffic based on the configured IP filters. See "Configuring IPv4 and IPv6 Access Control Lists" for details on creating and defining IPv4-ACLs.

> In the context of crypto maps, IPv4-ACLs are different from regular IPv4-ACLs. Regular IPv4-ACLs determine what traffic to forward or block at an interface. For example, IPv4-ACLs can be created to protect all IP traffic between subnet A and subnet Y or Telnet traffic between host A and host B.

> Crypto IPv4-ACLs are used to define which IP traffic requires crypto protection and which traffic does not.

> Crypto IPv4-ACLs associated with IPsec crypto map entries have four primary functions:

> - Select outbound traffic to be protected by IPsec (permit = protect).
> - Indicate the data flow to be protected by the new SAs (specified by a single permit entry) when initiating negotiations for IPsec SAs.
> - Process inbound traffic to filter out and discard traffic that should have been protected by IPsec.
> - Determine whether or not to accept requests for IPsec SAs on behalf of the requested data flows when processing IKE negotiation from the IPsec peer.

> Tip If you want some traffic to receive one type of IPsec protection (for example, encryption only) and other traffic to receive a different type of IPsec protection (for example, both authentication and encryption), create two IPv4-ACLs. Use both IPv4-ACLs in different crypto maps to specify different IPsec policies.

> Note IPsec does not support IPv6-ACLs.

> Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.