<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:55" />
    <title>Crypto IPv4-ACL Guidelines </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1753;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1079657"> </a><h1 class="pTitle">
Crypto IPv4-ACL Guidelines

</h1>
<a name="wp1075061"> </a><p class="pBody">
Follow these guidelines when configuring IPv4-ACLs for the IPsec feature:

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1075062"> </a><li class="pSmartList1">The Cisco NX-OS software only allows name-based IPv4-ACLs.
</li>
<a name="wp1075063"> </a><li class="pSmartList1">When an IPv4-ACL is applied to a crypto map, the following options apply:
</li>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1075064"> </a><li class="pSmartList2">Permit&#8212;Applies the IPsec feature to the traffic.</li>
<a name="wp1075065"> </a><li class="pSmartList2">Deny&#8212;Allows clear text (default).</li>
<a name="wp1075066"> </a><p class="pBodyAutonumRel">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> IKE traffic (UDP port 500) is implicitly transmitted in clear text.

</p>
</ul></div>
<a name="wp1075067"> </a><li class="pSmartList1">The IPsec feature only considers the source and destination IPv4 addresses and subnet masks, 
protocol, and single port number. There is no support for IPv6 in IPsec.
</li>
<a name="wp1075068"> </a><p class="pBodyAutonumRel">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> The IPsec feature does not support port number ranges and ignores higher port number field, 
if specified.

</p>
<a name="wp1075069"> </a><li class="pSmartList1">The permit option causes all IP traffic that matches the specified conditions to be protected by 
crypto, using the policy described by the corresponding crypto map entry.
</li>
<a name="wp1075070"> </a><li class="pSmartList1">The deny option prevents traffic from being protected by crypto. The first deny statement causes the 
traffic to be in clear text.
</li>
<a name="wp1075071"> </a><li class="pSmartList1">The crypto IPv4-ACL you define is applied to an interface after you define the corresponding crypto 
map entry and apply the crypto map set to the interface. 
</li>
<a name="wp1075072"> </a><li class="pSmartList1">Different IPv4-ACLs must be used in different entries of the same crypto map set. 
</li>
<a name="wp1075073"> </a><li class="pSmartList1">Inbound and outbound traffic is evaluated against the same outbound IPv4-ACL. Therefore, the 
IPv4-ACL&#39;s criteria is applied in the forward direction to traffic exiting your switch, and the reverse 
direction to traffic entering your switch. 
</li>
<a name="wp1075074"> </a><li class="pSmartList1">Each IPv4-ACL filter assigned to the crypto map entry is equivalent to one security policy entry. The 
IPsec feature supports up to 120 security policy entries for each MPS-14/2 module and Cisco MDS 
9216i Switch.
</li>
<a name="wp1075078"> </a><li class="pSmartList1">IPsec protection  is applied to traffic between switch interface S0 (IPv4 address 10.0.0.1) and switch 
interface S1 (IPv4 address 20.0.0.2) as the data exits switch A&#39;s S0 interface enroute to switch 
interface S1. For traffic from 10.0.0.1 to 20.0.0.2, the IPv4-ACL entry on switch A is evaluated as 
follows: 
</li>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1075079"> </a><li class="pSmartList2">source = IPv4 address 10.0.0.1</li>
<a name="wp1075080"> </a><li class="pSmartList2">dest = IPv4 address 20.0.0.2</li>
</ul></div>
<a name="wp1075081"> </a><p class="pListBodyLevel1">
For traffic from 20.0.0.2 to 10.0.0.1, that same IPv4-ACL entry on switch A is evaluated as follows: 

</p>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1075082"> </a><li class="pSmartList2">source = IPv4 address 20.0.0.2</li>
<a name="wp1075083"> </a><li class="pSmartList2">dest = IPv4 address 10.0.0.1</li>
</ul></div>
<a name="wp1075090"> </a><li class="pSmartList1">If you configure multiple statements for a given crypto IPv4-ACL that is used for IPsec, the first 
permit statement that is matched is used to determine the scope of the IPsec SA. Later, if traffic 
matches a different permit statement of the crypto IPv4-ACL, a new, separate IPsec SA is negotiated 
to protect traffic matching the newly matched IPv4-ACL statement. 
</li>
<a name="wp1075091"> </a><li class="pSmartList1">Unprotected inbound traffic that matches a permit entry in the crypto IPv4-ACL for a crypto map 
entry flagged as IPsec is dropped, because this traffic was expected to be protected by IPsec. 
</li>
<a name="wp1075093"> </a><li class="pSmartList1">For IPsec to interoperate effectively with Microsoft iSCSI initiators, specify the TCP protocol and 
the local iSCSI TCP port number (default 3260) in the IPv4-ACL. This configuration ensures the 
speedy recovery of encrypted iSCSI sessions following disruptions such as Gigabit Ethernet 
interfaces shutdowns, VRRP switchovers, and port failures. 
</li>
</ul></div>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
