<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>About Crypto IPv4-ACLs </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1739;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1074855"> </a><h1 class="pTitle">
About Crypto IPv4-ACLs

</h1>
<a name="wp1074856"> </a><p class="pBody">
IP access control lists (IPv4-ACLs) provide basic network security to all switches in the Cisco MDS 
9000 Family. IPv4 IP-ACLs restrict IP-related traffic based on the configured IP filters. See 
<a href="ipacl01.html">&quot;Configuring IPv4 and IPv6 Access Control Lists&quot;</a> for details on creating and defining IPv4-ACLs.

</p>
<a name="wp1073913"> </a><p class="pBody">
In the context of crypto maps, IPv4-ACLs are different from regular IPv4-ACLs. Regular IPv4-ACLs 
determine what traffic to forward or block at an interface. For example, IPv4-ACLs can be created to 
protect all IP traffic between subnet A and subnet Y or Telnet traffic between host A and host B.

</p>
<a name="wp1074960"> </a><p class="pBody">
Crypto IPv4-ACLs are used to define which IP traffic requires crypto protection and which traffic does 
not. 

</p>
<a name="wp1074961"> </a><p class="pBody">
Crypto IPv4-ACLs associated with IPsec crypto map entries have four primary functions: 

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1074962"> </a><li class="pSmartList1">Select outbound traffic to be protected by IPsec (permit = protect). 
</li>
<a name="wp1074963"> </a><li class="pSmartList1">Indicate the data flow to be protected by the new SAs (specified by a single permit entry) when 
initiating negotiations for IPsec SAs. 
</li>
<a name="wp1074964"> </a><li class="pSmartList1">Process inbound traffic to filter out and discard traffic that should have been protected by IPsec. 
</li>
<a name="wp1074965"> </a><li class="pSmartList1">Determine whether or not to accept requests for IPsec SAs on behalf of the requested data flows 
when processing IKE negotiation from the IPsec peer. 
</li>
<a name="wp1074966"> </a><p class="pBodyAutonumRel">
<strong>Tip	&nbsp;&nbsp;&nbsp;</strong> If you want some traffic to receive one type of IPsec protection (for example, encryption only) and other 
traffic to receive a different type of IPsec protection (for example, both authentication and encryption), 
create two IPv4-ACLs. Use both IPv4-ACLs in different crypto maps to specify different IPsec policies. 

</p>
</ul></div>
<a name="wp1074967"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> IPsec does not support IPv6-ACLs.

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
