ccna book for dummies

ccna book for dummies.negotiation determines how the IPSec tunnel is established. Step 4 The IPSec tunnel is established and data is transferred between IPSec peers based on the parameters configured in the IPSec transformation set. Step 5 The IPSec tunnel is terminated when the IPSec SA is deleted or its lifetime expires.8.4.1.2 IPSec Configuration TasksTo configure a site-to-site IPSec VPN, the following basic tasks must be completed. Task 1 Ensure that the ACLs configured on the interface are compatible with the IPSec configuration. There are usually restrictions on the interfaces used by VPN traffic, for example, blockingBlock all non-IPSec or IKE traffic. Task 2 Create an ISAKMP policy that determines the ISAKMP parameters used to establish the tunnel. Task 3 Configure the IPSec transform set. The transform set defines the parameters used for the IPSec tunnel. The transform set can include encryption and integrity calculationsmethods.Task 4 Create an encrypted ACL that defines which traffic travels through the IPSec tunnel and is protected by the IPSec process. Task 5 creates and applies a crypto map. The crypto map aggregates the previously configured parameters into groups and defines the IPSec peer devices. The crypto map is applied to the outgoing interface of the VPN device.8.4 Implementing Site-to-Site IPSecVPN Using the CLI 2358.4.2 Task 1 - Configuring Compatible ACLs8.4.2.1 Protocols 50 and 51, and the UPD side 500The first step in configuring CiscoIOSISAKMP is to ensure that existing ACLs on the border router, firewall, or other router do not block IPSec traffic. ACLs are typically used on border routers to implement restrictive security policies that allow only specific traffic and deny all other traffic. Because such a restrictive policy will block IPSec traffic, a dedicated permit statement must be added to the ACL.