User`s guide

346 XSR User’s Guide
Configuration Examples Chapter 13
Configuring Security on the XSR
XSR(config-isakmp-peer)#proposal xp soho p2p
XSR(config-isakmp-peer)#config-mode gateway
XSR(config-isakmp-peer)#nat-traversal automatic
Configure the following IPSec SAs:
XSR(config)#crypto ipsec transform-set esp-3des-md5 esp-3des esp-
md5-hmac
XSR(cfg-crypto-tran)no set security-association lifetime kilobytes
XSR(config)#crypto ipsec transform-set esp-3des-sha esp-3des esp-
sha-hmac
XSR(cfg-crypto-tran)set security-association lifetime kilobytes 10000
Configure the following four crypto maps to match ACLs 150, 140, 120, and 110:
XSR(config)#crypto map test 50
XSR(config-crypto-m)#set transform-set esp-3des-sha
XSR(config-crypto-m)#match address 150
XSR(config)#crypto map test 40
XSR(config-crypto-m)#set transform-set esp-3des-sha
XSR(config-crypto-m)#match address 140
XSR(config)#crypto map test 20
XSR(config-crypto-m)#set transform-set esp-3des-md5
XSR(config-crypto-m)#match address 120
XSR(config-crypto-m)#mode transport
XSR(config-crypto-m)#set security-association level per-host
XSR(config)#crypto map test 10
XSR(config-crypto-m)#set transform-set esp-3des-sha
XSR(config-crypto-m)#match address 110
Configure FastEthernet interface 1 to permit multicast packets in and out:
XSR(config)#interface FastEthernet1
XSR(config-ifF1>)#ip address 96.96.96.7 255.255.255.0
XSR(config-ifF1>)#ip firewall ip-multicast in
XSR(config-ifF1>)#ip firewall ip-multicast out
XSR(config-ifF1>)#no shutdown
Configure FastEthernet interface 2 with the attached crypto map test:
XSR(config)#interface FastEthernet2