crypto ipsec transform-set [name] esp-aes esp-sha-hmac
Defines an IPsec transform set specifying the encryption and authentication algorithms to protect VPN traffic, used when configuring an IPsec VPN policy.
Definition: crypto ipsec transform-set [name] esp-aes esp-sha-hmac is a Cisco IOS global config command. Defines an IPsec transform set specifying the encryption and authentication algorithms to protect VPN traffic, used when configuring an IPsec VPN policy.
Overview
The `crypto ipsec transform-set` command is a cornerstone of IPsec VPN configuration on Cisco IOS devices. It defines a transform set, which is a combination of security protocols and algorithms that protect the confidentiality, integrity, and authenticity of VPN traffic. Specifically, the command `crypto ipsec transform-set [name] esp-aes esp-sha-hmac` creates a transform set that uses ESP (Encapsulating Security Payload) with AES encryption and SHA-HMAC authentication. This command is essential when building site-to-site or remote-access IPsec VPNs, as it dictates how data is encrypted and authenticated. Without a properly configured transform set, IPsec cannot establish a secure tunnel.
The concept behind this command lies in IPsec's two main protocols: AH (Authentication Header) and ESP. ESP provides both encryption and optional authentication, while AH only provides authentication. In modern networks, ESP is preferred because it offers confidentiality. The transform set specifies the exact algorithms: for example, `esp-aes` indicates AES encryption (with a default key length of 128 bits, though you can specify 192 or 256 with `esp-aes 192` or `esp-aes 256`), and `esp-sha-hmac` uses HMAC-SHA1 for integrity. Alternatives include `esp-des` (obsolete), `esp-3des` (legacy), or `esp-gcm` (for authenticated encryption). You would reach for this command when configuring an IPsec profile or crypto map, typically after defining ISAKMP (IKE) policies. It fits into the broader VPN workflow: first, configure IKE phase 1 (ISAKMP policy), then define the transform set for phase 2, and finally apply it to a crypto map or tunnel interface.
Important IOS behaviors: The transform set is stored in the running configuration and can be viewed with `show crypto ipsec transform-set`. It does not require a reload to take effect, but it must be referenced by a crypto map or IPsec profile to be active. The command is available in global configuration mode, and privilege level 15 is required. If you omit the transform set name, the command will prompt for it. A common mistake is forgetting to specify the mode (tunnel or transport) — the default is tunnel, which is correct for most site-to-site VPNs. Also, mixing incompatible algorithms (e.g., using ESP with AH-only authentication) can cause negotiation failures. The transform set must match on both peers for the IPsec tunnel to establish.
crypto ipsec transform-set [name] esp-aes esp-sha-hmacWhen to Use This Command
- Setting up a site-to-site VPN between two branch offices using AES encryption and SHA-HMAC authentication.
- Configuring a remote-access VPN for mobile workers with strong encryption (ESP-AES) and integrity checking (ESP-SHA-HMAC).
- Creating multiple transform sets for different security levels (e.g., one for internal traffic, another for partner connections).
- Upgrading an existing VPN from DES to AES for better security compliance.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| name | WORD (1-64 characters) | A descriptive name for the transform set, such as 'MYSET' or 'AES-SHA'. It must be unique within the device. Common mistakes include using spaces or special characters, or reusing a name already assigned to another transform set. |
| esp-aes | esp-aes [128|192|256] | Specifies AES encryption with a key length of 128 bits (default), 192, or 256. This is the encryption algorithm for ESP. Common mistakes: forgetting to specify the key length if needed, or using 'esp-aes' without realizing the default is 128 bits, which may not meet security requirements. |
| esp-sha-hmac | esp-sha-hmac | Specifies HMAC-SHA1 for authentication/integrity. This ensures data integrity and origin authentication. Common mistakes: confusing with 'esp-sha256-hmac' (available in newer IOS) or using 'esp-md5-hmac' which is weaker. Note that SHA1 is considered deprecated in some environments; use SHA256 for stronger security. |
Command Examples
Basic transform set with AES-128 and SHA-HMAC
crypto ipsec transform-set MYSET esp-aes esp-sha-hmaccrypto ipsec transform-set MYSET esp-aes esp-sha-hmac mode tunnel
The command creates a transform set named MYSET using AES encryption (128-bit key) and SHA-HMAC authentication. The output confirms the transform set and shows default mode (tunnel).
Transform set with AES-256 and SHA-HMAC in transport mode
crypto ipsec transform-set STRONG esp-aes 256 esp-sha-hmac
mode transportcrypto ipsec transform-set STRONG esp-aes 256 esp-sha-hmac mode transport
This variant specifies AES with 256-bit key and sets transport mode (used for GRE/IPsec or end-to-end). The output shows the transform set and its mode.
Understanding the Output
The output of 'show crypto ipsec transform-set' lists each configured transform set. For each set, it shows the name, the encryption algorithm (e.g., esp-aes, esp-aes 256), the authentication algorithm (e.g., esp-sha-hmac), and the mode (tunnel or transport). In a real network, you verify that the transform set matches on both VPN peers; mismatched algorithms cause negotiation failure.
A good output shows the expected algorithms; a bad output might show 'none' for encryption or authentication, or an unexpected mode. Always check that the transform set is applied to a crypto map and that the peer's transform set is identical.
Configuration Scenarios
Configure a Site-to-Site IPsec VPN between Two Branch Routers
Two branch offices need to securely communicate over the internet. Each router has a public IP address and a private LAN. The goal is to establish an IPsec tunnel using AES-256 encryption and SHA-1 authentication.
Topology
Branch1 (Gi0/0: 203.0.113.1)---Internet---(Gi0/0: 198.51.100.1) Branch2
Branch1 LAN: 10.1.1.0/24
Branch2 LAN: 10.2.2.0/24Steps
- 1.Step 1: Enter global configuration mode on Branch1: configure terminal
- 2.Step 2: Create the transform set: crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac
- 3.Step 3: (Optional) Set the mode to tunnel (default): crypto ipsec transform-set AES256-SHA mode tunnel
- 4.Step 4: Define the crypto map: crypto map VPN-MAP 10 ipsec-isakmp
- 5.Step 5: Set the peer IP: set peer 198.51.100.1
- 6.Step 6: Set the transform set: set transform-set AES256-SHA
- 7.Step 7: Match the interesting traffic: match address 101
- 8.Step 8: Apply the crypto map to the outside interface: interface GigabitEthernet0/0, crypto map VPN-MAP
- 9.Step 9: Repeat similar steps on Branch2 with peer 203.0.113.1
! Branch1 configuration crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac ! crypto map VPN-MAP 10 ipsec-isakmp set peer 198.51.100.1 set transform-set AES256-SHA match address 101 ! interface GigabitEthernet0/0 ip address 203.0.113.1 255.255.255.0 crypto map VPN-MAP ! access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
Verify: Use 'show crypto ipsec transform-set' to verify the transform set exists. Use 'show crypto ipsec sa' to see active security associations. Expected output shows the transform set name, algorithms, and SA details like SPI, encryption, and authentication keys.
Watch out: Forgetting to apply the crypto map to the interface. The transform set itself does not activate until referenced by a crypto map. Also, ensure both peers have matching transform sets; otherwise, IKE phase 2 will fail.
Configure a Remote-Access VPN with a Dynamic Crypto Map
A central office needs to support multiple remote clients with dynamic IP addresses. The transform set must be flexible to allow various encryption algorithms. Here we use AES-128 and SHA-1 as a baseline.
Topology
Central (Gi0/0: 192.0.2.1)---Internet---Remote Clients (dynamic IPs)
Central LAN: 172.16.0.0/16Steps
- 1.Step 1: Enter global configuration mode on Central: configure terminal
- 2.Step 2: Create the transform set: crypto ipsec transform-set DYNAMIC-SET esp-aes esp-sha-hmac
- 3.Step 3: Create a dynamic crypto map: crypto dynamic-map DYNAMIC-MAP 10
- 4.Step 4: Set the transform set: set transform-set DYNAMIC-SET
- 5.Step 5: Create a static crypto map referencing the dynamic map: crypto map STATIC-MAP 10 ipsec-isakmp dynamic DYNAMIC-MAP
- 6.Step 6: Apply the static crypto map to the outside interface: interface GigabitEthernet0/0, crypto map STATIC-MAP
- 7.Step 7: Configure IKE policies and AAA for client authentication (not shown)
! Central configuration crypto ipsec transform-set DYNAMIC-SET esp-aes esp-sha-hmac ! crypto dynamic-map DYNAMIC-MAP 10 set transform-set DYNAMIC-SET ! crypto map STATIC-MAP 10 ipsec-isakmp dynamic DYNAMIC-MAP ! interface GigabitEthernet0/0 ip address 192.0.2.1 255.255.255.0 crypto map STATIC-MAP !
Verify: Use 'show crypto dynamic-map' to verify the dynamic map. Use 'show crypto ipsec sa' to see SAs established by remote clients. Expected output shows the transform set and SA details for each client.
Watch out: Dynamic crypto maps do not allow specifying a peer; they accept connections from any peer. Ensure that IKE policies are configured correctly and that the transform set matches what the remote clients propose. Also, note that dynamic maps cannot be applied directly to an interface; they must be wrapped in a static crypto map.
Troubleshooting with This Command
When troubleshooting IPsec VPN issues, the `crypto ipsec transform-set` command is primarily used for verification rather than active troubleshooting. However, understanding its output is critical. Use `show crypto ipsec transform-set` to list all configured transform sets.
Healthy output shows the transform set name, the encryption algorithm (e.g., esp-aes), the authentication algorithm (e.g., esp-sha-hmac), and the mode (tunnel or transport). If the transform set is missing or incorrectly configured, the output will be absent or show wrong algorithms. Common symptoms include: IKE phase 2 failures with messages like 'no matching transform set' or 'proposal mismatch'.
This indicates that the transform set on one peer does not match the other. Focus on the 'transform set' field in `show crypto ipsec sa` — if the SA shows 'transform set: (none)', the transform set was not applied. Another symptom is that the tunnel establishes but traffic is not encrypted; check if the transform set includes encryption (esp-aes) and authentication (esp-sha-hmac).
If only authentication is specified, data is not encrypted. A step-by-step diagnostic flow: 1) Verify transform set exists on both peers with `show crypto ipsec transform-set`. 2) Check that the transform set is referenced in the crypto map with `show crypto map`. 3) Use `debug crypto ipsec` to see detailed negotiation messages. Look for lines like 'transform set proposal: {esp-aes esp-sha-hmac }' and compare with the peer's proposal.
If mismatched, adjust the transform set to match. Correlate with `show crypto isakmp sa` to ensure IKE phase 1 is complete. If phase 1 is up but phase 2 fails, the transform set is the likely culprit.
Also, check for ACL misconfigurations that might not match the traffic to be encrypted. The command `show crypto ipsec transform-set` can also reveal if the transform set uses weak algorithms (like DES) that may be rejected by security policies. In summary, this command is a read-only diagnostic tool that helps identify configuration mismatches and algorithm support issues.
CCNA Exam Tips
CCNA exam tip 1: The default mode is tunnel; transport mode is only used for GRE/IPsec or when the endpoints are the same as the VPN gateways.
CCNA exam tip 2: The transform set must match exactly on both peers (same encryption, authentication, and mode) for IPsec to establish.
CCNA exam tip 3: 'esp-aes' without a key length implies 128-bit; you can specify 192 or 256 for stronger encryption.
CCNA exam tip 4: The command does not activate the transform set; it must be referenced in a crypto map.
Common Mistakes
Mistake 1: Forgetting to apply the transform set to a crypto map – the transform set is defined but never used, so VPN fails.
Mistake 2: Using mismatched transform sets on peers (e.g., one uses esp-aes and the other uses esp-3des) – negotiation fails.
Mistake 3: Confusing 'esp-sha-hmac' with 'esp-sha' – the '-hmac' suffix is required for the HMAC variant; omitting it may cause errors.
crypto ipsec transform-set [name] esp-aes esp-sha-hmac vs crypto map [name] [seq] ipsec-isakmp
Both commands are essential for IPsec VPN configuration on Cisco IOS devices, but they serve different roles: the transform set defines the encryption and authentication algorithms used in the IPsec SA, while the crypto map binds these algorithms to a peer and applies the policy to an interface. They are commonly confused because they are often configured together in a typical site-to-site VPN setup.
| Aspect | crypto ipsec transform-set [name] esp-aes esp-sha-hmac | crypto map [name] [seq] ipsec-isakmp |
|---|---|---|
| Scope | Defines algorithm suite for a single transform set | Defines entire IPsec policy including peer, transform set, and ACL |
| Configuration mode | Global configuration | Global configuration |
| Persistence | Persists in running-config; referenced by crypto map | Persists in running-config; applied to interface |
| Precedence | No ordering; multiple transform sets can be defined | Sequence numbers define priority when matching traffic |
| Typical use | Used to specify encryption (AES) and integrity (SHA) for IPsec SA | Used to associate a transform set with a peer and ACL |
Use crypto ipsec transform-set [name] esp-aes esp-sha-hmac when you need to define a specific encryption and authentication algorithm combination for IPsec protection.
Use crypto map [name] [seq] ipsec-isakmp when you need to define an IPsec policy that includes peer address, transform set, and access list, and then apply it to an interface.
Platform Notes
In IOS-XE (e.g., CSR1000v, ISR 4000 series), the syntax is identical to classic IOS. However, IOS-XE supports additional transform set options like `esp-gcm` and `esp-gmac` for authenticated encryption. The output of `show crypto ipsec transform-set` is similar but may include additional fields like 'compression' (if configured).
In NX-OS (Cisco Nexus switches), the equivalent command is `crypto ipsec transform-set [name] esp-aes [128|192|256] esp-sha-hmac` but note that NX-OS uses a different configuration model for IPsec; it often requires an IPsec policy and a crypto map. The exact NX-OS syntax is `crypto ipsec transform-set [name] [esp-aes [128|192|256]] [esp-sha-hmac]`. On Cisco ASA firewalls, the equivalent is `crypto ipsec ikev2 ipsec-proposal [name]` or `crypto ipsec transform-set [name]` in older versions.
ASA uses a different paradigm: transform sets are defined under `crypto ipsec transform-set` but the ASA also uses `crypto map` and `tunnel-group`. For IOS-XR (Cisco ASR 9000, NCS 5500), the command is not directly available; IOS-XR uses a different IPsec configuration model based on `ipsec transform-set` under `crypto` configuration, but the syntax is similar: `ipsec transform-set [name] esp-aes esp-sha-hmac`. However, IOS-XR requires explicit mode configuration.
Between IOS versions, note that 12.x supports only up to AES-128 by default, while 15.x and 16.x support AES-256 and additional algorithms like SHA256. Always check the specific IOS version documentation for algorithm support.
Related Commands
crypto isakmp policy [priority]
Creates or modifies an ISAKMP (IKE) policy for IPsec VPN negotiations, defining encryption, authentication, and key exchange parameters.
crypto map [name] [seq] ipsec-isakmp
Creates or modifies a crypto map entry for IPsec VPN configuration, defining the security policies and peer parameters for IKE and IPsec negotiations.
show crypto ipsec sa
Displays the current state and statistics of IPsec security associations (SAs) to verify VPN tunnel establishment and monitor encrypted traffic.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions