<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>The any Keyword in Crypto IPv4-ACLs  </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1741;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1075233"> </a><h1 class="pTitle">
The any Keyword in Crypto IPv4-ACLs 

</h1>
<a name="wp1075234"> </a><p class="pBodyAutonumRel">
<strong>Tip	&nbsp;&nbsp;&nbsp;</strong> We recommend that you configure mirror image crypto IPv4-ACLs for use by IPsec and that you avoid 
using the <b class="cBold">any</b> option. 

</p>
<a name="wp1075235"> </a><p class="pBody">
The <b class="cBold">any</b> keyword in a permit statement is discouraged when you have multicast traffic flowing through 
the IPsec interface. This configuration can cause multicast traffic to fail. 

</p>
<a name="wp1075236"> </a><p class="pBody">
The <b class="cBold">permit any </b>statement causes all outbound traffic to be protected (and all protected traffic sent to the 
peer specified in the corresponding crypto map entry) and requires protection for all inbound traffic. 
Then, all inbound packets that lack IPsec protection are silently dropped, including packets for routing 
protocols, NTP, echo, echo response, and so forth. 

</p>
<a name="wp1075237"> </a><p class="pBody">
You need to be sure you define which packets to protect. If you must use <b class="cBold">any</b> in a permit statement, you 
must preface that statement with a series of deny statements to filter out any traffic (that would otherwise 
fall within that permit statement) that you do not want to be protected.

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
