<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>SA Establishment Between Peers </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1744;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1075843"> </a><h1 class="pTitle">
SA Establishment Between Peers

</h1>
<a name="wp1075844"> </a><p class="pBody">
When two peers try to establish an SA, they must each have at least one crypto map entry that is 
compatible with one of the other peer&#39;s crypto map entries. 

</p>
<a name="wp1075845"> </a><p class="pBody">
For two crypto map entries to be compatible, they must at least meet the following criteria: 

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1075846"> </a><li class="pSmartList1">The crypto map entries must contain compatible crypto IPv4-ACLs (for example, mirror image 
IPv4-ACLs). If the responding peer entry is in the local crypto, the IPv4-ACL must be permitted by 
the peer&#39;s crypto IPv4-ACL. 
</li>
<a name="wp1075847"> </a><li class="pSmartList1">The crypto map entries must each identify the other peer or must have auto peer configured. 
</li>
<a name="wp1075848"> </a><li class="pSmartList1">If you create more than one crypto map entry for a given interface, use the seq-num of each map 
entry to rank the map entries: the lower the seq-num, the higher the priority. At the interface that has 
the crypto map set, traffic is evaluated against higher priority map entries first. 
</li>
<a name="wp1075849"> </a><li class="pSmartList1">The crypto map entries must have at least one transform set in common, where IKE negotiations are 
carried out and SAs are established. During the IPsec SA negotiation, the peers agree to use a 
particular transform set when protecting a particular data flow. 
</li>
</ul></div>
<a name="wp1075850"> </a><p class="pBody">
When a packet matches a permit entry in a particular IPv4-ACL, the corresponding crypto map entry is 
tagged, and the connections are established.

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
