Cisco FirePOWER ASA 5500 series Configuration Manual page 523

Chapter 27 Configuring IPSec and ISAKMP
Map the lists to one or more crypto maps, using the same crypto map name.
Step 2
Map the transform sets to the crypto maps to apply IPSec to the data flows.
Step 3
Apply the crypto maps collectively as a "crypto map set" by assigning the crypto map name they share
Step 4
to the interface.
In Figure
exits the outside interface on Security Appliance A toward Host 10.2.2.2.
Figure 27-4
Host
10.0.0.1
Security Appliance A evaluates traffic from Host 10.0.0.1 to Host 10.2.2.2, as follows:
source = host 10.0.0.1
•
dest = host 10.2.2.2
•
Security Appliance A also evaluates traffic from Host 10.2.2.2 to Host 10.0.0.1, as follows:
source = host 10.2.2.2
•
dest = host 10.0.0.1
•
The first permit statement that matches the packet under evaluation determines the scope of the
IPSec SA.
Note If you delete the only element in an access list, the security appliance also removes the associated crypto
map.
If you modify an access list currently referenced by one or more crypto maps, use the crypto map
interface command to reinitialize the run-time SA database. See the crypto map command for more
information.
We recommend that for every crypto access list specified for a static crypto map that you define at the
local peer, you define a "mirror image" crypto access list at the remote peer. The crypto maps should
also support common transforms and refer to the other system as a peer. This ensures correct processing
of IPSec by both peers.
OL-10088-01
27-4, IPSec protection applies to traffic between Host 10.0.0.1 and Host 10.2.2.2 as the data
How Crypto Access Lists Apply to IPSec
outside
Security
Appliance
Firewall A
IPSec Access List at "outside" interface:
access-list 101 permit ip host 10.0.0.1 host 10.2.2.2
Traffic exchanged between hosts 10.0.0.1 and 10.2.2.2 is protected between
Security Appliance Firewall A "outside" and Security Appliance Firewall B "outside"
IPSec peers
Internet
outside
Appliance
Firewall B
IPSec Access List at "outside" interface:
access-list 111 permit ip host 10.2.2.2 host 10.0.0.1
Cisco Security Appliance Command Line Configuration Guide
Configuring IPSec
Host
10.2.2.2
Security
27-21