The Any Keyword In Crypto Ipv4-Acls - Cisco AP776A - Nexus Converged Network Switch 5020 Configuration Manual

Crypto IPv4-ACLs
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
Figure 37-6
Mirror image
access lists at
Switch M S0
Router N S1
As
IPv4-ACLs are mirror images of each other. However, an IPsec SA can be established only some of the
time when the IPv4-ACLs are not mirror images of each other. This can happen in the case when an entry
in one peer's IPv4-ACL is a subset of an entry in the other peer's IPv4-ACL, such as shown in cases 3
and 4 of
causing any packets matching the crypto IPv4-ACL criteria to be silently dropped instead of being
forwarded with IPsec security.
In case 4, an SA cannot be established because SAs are always requested according to the crypto
IPv4-ACLs at the initiating packet's end. In case 4, router N requests that all traffic between subnet X
and subnet Y be protected, but this is a superset of the specific flows permitted by the crypto IPv4-ACL
at switch M so the request is not permitted. Case 3 works because switch M's request is a subset of the
specific flows permitted by the crypto IPv4-ACL at router N.
Because of the complexities introduced when crypto IPv4-ACLs are not configured as mirror images at
peer IPsec devices, we strongly encourage you to use mirror image crypto IPv4-ACLs.

The any Keyword in Crypto IPv4-ACLs

We recommend that you configure mirror image crypto IPv4-ACLs for use by IPsec and that you avoid
Tip
using the any option.
The any keyword in a permit statement is discouraged when you have multicast traffic flowing through
the IPsec interface. This configuration can cause multicast traffic to fail.
Cisco MDS 9000 Family CLI Configuration Guide
37-20
IPsec Processing of Mirror Image Configuration
Subnet X
Switch M
IPSec access list at S0
permits
Case 1
Switch M
permits
Subnet X
Case 2
and
permits
Case 3
Switch M
Case 4
Figure 37-6 indicates, IPsec SAs can be established as expected whenever the two peers' crypto
Figure 37-6. IPsec SA establishment is critical to IPsec. Without SAs, IPsec does not work,
S0
Internet
IPSec access list at S1
permits
Host B Host B
permits
Subnet Y Subnet Y
permits
Host B Subnet Y
Chapter 37 Configuring IPsec Network Security
Subnet Y
Host B
Router N
Host C
S1
1st packet
M B
Switch M or B M
M B
or B M
Subnet X
or M C
M B
Subnet X
B M
OL-18084-01, Cisco MDS NX-OS Release 4.x
Result
SAs established for
Traffic M B (good
SAs established for
Traffic X Y (good
SAs established for
Traffic M B (good
SAs cannot be
established and
packets from Host
B to Switch M are
dropped (bad)