<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>About Transform Sets in IPsec </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1742;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1075460"> </a><h1 class="pTitle">
About Transform Sets in IPsec

</h1>
<a name="wp1075461"> </a><p class="pBody">
A transform set represents a certain combination of security protocols and algorithms. During the IPsec 
security association negotiation, the peers agree to use a particular transform set for protecting a 
particular data flow. 

</p>
<a name="wp1075462"> </a><p class="pBody">
You can specify multiple transform sets, and then specify one or more of these transform sets in a crypto 
map entry. The transform set defined in the crypto map entry is used in the IPsec security association 
negotiation to protect the data flows specified by that crypto map entry&#39;s access list. 

</p>
<a name="wp1075463"> </a><p class="pBody">
During IPsec security association negotiations with IKE, the peers search for a transform set that is the 
same at both peers. When such a transform set is found, it is selected and applied to the protected traffic 
as part of both peers&#39; IPsec security associations. 

</p>
<a name="wp1075464"> </a><p class="pBodyAutonumRel">
<strong>Tip	&nbsp;&nbsp;&nbsp;</strong> If you change a transform set definition, the change is only applied to crypto map entries that reference 
the transform set. The change is not applied to existing security associations, but used in subsequent 
negotiations to establish new security associations. If you want the new settings to take effect sooner, 
you can clear all or part of the security association database. 

</p>
<a name="wp1075465"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> When you enable IPsec, the Cisco NX-OS software automatically creates a default transform set 
(ipsec_default_tranform_set) using AES-128 encryption and SHA-1 authentication algorithms.

</p>
<a name="wp1075469"> </a><p class="pBody">
<a href="ipe20.html#wp1075473">Table&#160;36-2</a> provides a list of allowed transform combinations for IPsec.

</p>
<a name="wp1075513"> </a><p class="pBodyRelative">
</p><div>
<table border="2" cellpadding="2" id="wp1075473table1075470">
  <caption><a name="wp1075473"> </a><div class="pTableTitle">
Table&#160;36-2	IPsec Transform Configuration Parameters

</div>
</caption>
  <tr bgcolor="#CCCCCC" align="left" valign="middle">    <th><a name="wp1075479"> </a><p class="pCellHeading">
Parameter

</p>
</th>
    <th><a name="wp1075481"> </a><p class="pCellHeading">
Accepted Values 

</p>
</th>
    <th><a name="wp1075483"> </a><p class="pCellHeading">
Keyword  

</p>
</th>
</tr>
  <tr align="left" valign="top">    <td><a name="wp1075485"> </a><p class="pBody">
encryption algorithm

</p>
</td>
    <td><a name="wp1075487"> </a><p class="pBody">
56-bit DES-CBC 

</p>
<a name="wp1075488"> </a><p class="pBody">
168-bit DES

</p>
<a name="wp1075489"> </a><p class="pBody">
128-bit AES-CBC

</p>
<a name="wp1075493"> </a><p class="pBody">
128-bit AES-CTR<a href="#wp1075492"><sup class="Footnote">1</sup></a>

</p>
<a name="wp1075494"> </a><p class="pBody">
256-bit AES-CBC

</p>
<a name="wp1075495"> </a><p class="pBody">
256-bit AES-CTR<sup class="cSuperscript">1
</sup>
</p>
</td>
    <td><a name="wp1075497"> </a><p class="pBody">
<b class="cBold">esp-des</b> 

</p>
<a name="wp1075498"> </a><p class="pBody">
<b class="cBold">esp-3des
</b>
</p>
<a name="wp1075499"> </a><p class="pBody">
<b class="cBold">esp-aes 128 
</b>
</p>
<a name="wp1075500"> </a><p class="pBody">
<b class="cBold">esp-aes 128 ctr
</b>
</p>
<a name="wp1075501"> </a><p class="pBody">
<b class="cBold">esp-</b>aes 256

</p>
<a name="wp1075502"> </a><p class="pBody">
<b class="cBold">esp-aes </b>256 ctr

</p>
</td>
</tr>
  <tr align="left" valign="top">    <td><a name="wp1075504"> </a><p class="pBody">
hash/authentication algorithm<sup class="cSuperscript">1</sup> 
(optional)

</p>
</td>
    <td><a name="wp1075506"> </a><p class="pBody">
SHA-1 (HMAC variant) 

</p>
<a name="wp1075507"> </a><p class="pBody">
MD5 (HMAC variant)

</p>
<a name="wp1075508"> </a><p class="pBody">
AES-XCBC-MAC

</p>
</td>
    <td><a name="wp1075510"> </a><p class="pBody">
<b class="cBold">esp-sha1-hmac</b> 

</p>
<a name="wp1075511"> </a><p class="pBody">
<b class="cBold">esp-md5-hmac
</b>
</p>
<a name="wp1075512"> </a><p class="pBody">
<b class="cBold">esp-</b>aes-xcbc-mac

</p>
</td>
</tr>
</table>

<table>
  <tr>
    <td><a name="wp1075492"> </a><p class="pTableFootnote">
<a href="#wp1075493"><sup class="Footnote">1</sup></a>If you configure the AES counter (CTR) mode, you must also configure the authentication algorithm.

</p>
</td>
  </tr>
</table>
</div>
<p class="pBodyRelative">
</p>
<a name="wp1075514"> </a><p class="pBody">
The following table lists the supported and verified settings for IPsec and IKE encryption authentication 
algorithms on the Microsoft Windows and Linux platforms:</p><div>
<table border="2" cellpadding="2" id="wp1075517table1075515">
  <caption></caption>
  <tr bgcolor="#CCCCCC" align="left" valign="middle">    <th><a name="wp1075517"> </a><p class="pCellHeading">
Platform

</p>
</th>
    <th><a name="wp1075519"> </a><p class="pCellHeading">
IKE

</p>
</th>
    <th><a name="wp1075521"> </a><p class="pCellHeading">
IPsec

</p>
</th>
</tr>
  <tr align="left" valign="top">    <td><a name="wp1075523"> </a><p class="pBody">
Microsoft iSCSI initiator, 
Microsoft IPsec implementation 
on Microsoft Windows 2000 
platform

</p>
</td>
    <td><a name="wp1075525"> </a><p class="pBody">
3DES, SHA-1 or MD5, <br />
DH group 2 

</p>
</td>
    <td><a name="wp1075527"> </a><p class="pBody">
3DES, SHA-1

</p>
</td>
</tr>
  <tr align="left" valign="top">    <td><a name="wp1075529"> </a><p class="pBody">
Cisco iSCSI initiator,<br />
Free Swan IPsec implementation 
on Linux platform

</p>
</td>
    <td><a name="wp1075531"> </a><p class="pBody">
3DES, MD5, DH group 1

</p>
</td>
    <td><a name="wp1075533"> </a><p class="pBody">
3DES, MD5

</p>
</td>
</tr>
</table>
</div>
<p class="pBody">

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
