Perfect Forward Secrecy; Crypto Map Set Interface Application - Cisco DS-X9530-SF1-K9 - Supervisor-1 Module - Control Processor Configuration Manual

Chapter 30 Configuring IPsec Network Security
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m .

Perfect Forward Secrecy

To specify SA lifetime negotiation values, you can also optionally configure the perfect forward secrecy
(PFS) value in the crypto map.
The PFS feature is disabled by default. If you set the PFS group, you can set one of DH groups: 1, 2, 5,
or 14. If you do not specify a DH group, the software uses group 1 by default.
To configure the PFS value, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# crypto map
SampleMap 31
ips-hac1(config-crypto-map-ip)#
Step 3
switch(config-crypto-map-ip)# set pfs
group 2
switch(config-crypto-map-ip)# no set pfs

Crypto Map Set Interface Application

You need to apply a crypto map set to each interface through which IPsec traffic will flow. Applying the
crypto map set to an interface instructs the switch to evaluate all the interface's traffic against the crypto
map set and to use the specified policy during connection or SA negotiation on behalf of traffic to be
protected by crypto.
You can apply only one crypto map set to an interface. You can apply the same crypto map to multiple
interfaces. However, you cannot apply more than one crypto map set to each interface.
To apply a crypto map set to an interface, follow these steps:
Command
Step 1
switch# config terminal
switch(config)#
Step 2
switch(config)# interface gigabitethernet 4/1
switch(config-if)#
Step 3
switch(config-if)# crypto map domain ipsec cm10
Step 4
switch(config-if)# no crypto map domain ipsec
OL-6973-03, Cisco MDS SAN-OS Release 2.x
Purpose
Enters configuration mode.
Place you in the crypto map configuration mode for
domain ipsec
the entry named SampleMap with 31 as its sequence
number.
Specifies that IPsec should ask for PFS when
requesting new SAs for this crypto map entry, or
should demand PFS in requests received from the
IPsec peer.
Deletes the configured DH group and reverts to the
factory default of disabling PFS.
Purpose
Enters configuration mode.
Selects the required Gigabit Ethernet interface
(and subinterface, if required) to which the
IPsec crypto map is to be applies.
Applies the crypto map set to the selected
interface.
Deletes the crypto map that is currently
applied to this interface.
Cisco MDS 9000 Family Configuration Guide
Configuring IPsec
30-21