5.1

3 Match Each Peer with Its Pre-Shared Secret
Router# config term
Router(config)# crypto isakmp key vshield
address 10.115.199.103
Router(config-isakmp)# exit
4 Define the IPSEC Transform
Router# config term
Router(config)# crypto ipsec transform-set
myset esp-3des esp-sha-hmac
Router(config-isakmp)# exit
5 Create the IPSEC Access List
Router# config term
Enter configuration commands, one per line.
End with CNTL/Z.
Router(config)# access-list 101 permit ip
172.16.0.0 0.0.255.255 192.168.5.0 0.0.0.255
Router(config)# exit
6 Bind the Policy with a Crypto Map and Label It
In the following example, the crypto map is labeled MYVPN
Router# config term
Router(config)# crypto map MYVPN 1
ipsec-isakmp
% NOTE: This new crypto map will remain
disabled until a peer and a valid
access list have been configured.
Router(config-crypto-map)# set transform-set
myset
Router(config-crypto-map)# set pfs group1
Router(config-crypto-map)# set peer
10.115.199.103
Router(config-crypto-map)# match address 101
Router(config-crypto-map)# exit
Example: Example Configuration
router2821#show running-config output
Building configuration...
Current configuration : 1263 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname router2821
!
boot-start-marker
boot-end-marker
!
! card type command needed for slot 0
! card type command needed for slot 1
Chapter 9 vShield Edge Management
VMware, Inc. 89