Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Crypto map question

Hi

If I have 2 crypto maps defined on my pix 506E. Traffic of my first crypto map goes for tunnel 1 & traffic of my second interface goes for tunnel2.

I can't apply the command crypto map CCS interface outside & crypto map PLC interface outside.

I am able to apply only one.

How can I do to use both crypto maps?

crypto ipsec transform-set my_PLC esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 86400

crypto map PLC 30 ipsec-isakmp

crypto map PLC 30 match address PLC

crypto map PLC 30 set peer 10.10.10.1

crypto map PLC 30 set transform-set my_PLC

crypto map PLC interface outside

isakmp key ******* address 10.10.10.1 netmask 255.255.255.255

isakmp identity address

isakmp policy 30 authentication pre-share

isakmp policy 30 encryption 3des

isakmp policy 30 hash md5

isakmp policy 30 group 2

isakmp policy 30 lifetime 86400

crypto ipsec transform-set my_ccs esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 86400

crypto map CCS 20 ipsec-isakmp

crypto map CCS 20 match address CCS

crypto map CCS 20 set peer 20.20.20.1

crypto map CCS 20 set transform-set my_ccs

crypto map CCS interface outside

isakmp key ****** address 20.20.20.1 netmask 255.255.255.255

isakmp identity address

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption 3des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

2 REPLIES
New Member

Re: Crypto map question

Crypto maps are like access list, one per direction,one per interface. Create a single crypto map to combine both previous crypto maps. An alternative is to maybe use GRE over ipsec and let a routing protocol select the best path for traffic and it will still be encrypted via the ipsec vpn.

Hall of Fame Super Blue

Re: Crypto map question

Hi

You can only have one crypto map per interface but you can have separate entries within the same crypto map eg.

crypto map CCS 20 ipsec-isakmp

crypto map CCS 20 match address CCS

crypto map CCS 20 set peer 20.20.20.1

crypto map CCS 20 set transform-set my_ccs

crypto map CCS 30 ipsec-isakmp

crypto map CCS 30 match address PLC

crypto map CCS 30 set peer 10.10.10.1

crypto map CCS 30 set transform-set my_PLC

crypto map CCS interface outside

HTH

Jon

168
Views
4
Helpful
2
Replies
CreatePlease to create content