crypto map [name] [seq] ipsec-isakmp
Creates or modifies a crypto map entry for IPsec VPN configuration, defining the security policies and peer parameters for IKE and IPsec negotiations.
Definition: crypto map [name] [seq] ipsec-isakmp is a Cisco IOS global config command. Creates or modifies a crypto map entry for IPsec VPN configuration, defining the security policies and peer parameters for IKE and IPsec negotiations.
Overview
The `crypto map` command is a cornerstone of IPsec VPN configuration on Cisco IOS devices. It creates or modifies a crypto map entry that defines the security policies, peer parameters, and transform sets used during IKE and IPsec negotiations. A crypto map essentially links the IPsec security associations (SAs) to a specific interface, enabling the router to protect traffic matching certain access control lists (ACLs) by encrypting it and sending it to a remote peer. This command is critical for site-to-site VPNs, remote access VPNs, and any scenario where data confidentiality, integrity, and authentication are required over an untrusted network like the Internet.
Networking concept: IPsec operates in two phases. Phase 1 (IKE) establishes a secure channel between peers, and Phase 2 (IPsec) negotiates the actual encryption and authentication parameters for data traffic. The crypto map ties these phases together by specifying the peer IP address, the transform set (encryption and hashing algorithms), the ACL that defines interesting traffic, and other parameters like lifetime and PFS (Perfect Forward Secrecy). Without a crypto map, IPsec cannot be applied to an interface.
When to use this command: You reach for `crypto map` when you need to configure a new VPN tunnel or modify an existing one. Alternatives include using a tunnel interface with IPsec (e.g., `tunnel protection ipsec`) which is often simpler for point-to-point tunnels, but crypto maps offer more granular control and are necessary for hub-and-spoke topologies or when using dynamic crypto maps for remote access. In modern IOS-XE, the trend is toward tunnel protection, but crypto maps remain widely used and are essential for CCNA/CCNP exams.
Workflow: Typically, you first configure IKE policies (crypto isakmp policy), then define transform sets (crypto ipsec transform-set), create an ACL to identify interesting traffic, and finally create a crypto map that references these components. The crypto map is then applied to an interface with the `crypto map` interface command. The command can be used in global configuration mode to create or edit an entry. Each entry has a sequence number; lower numbers are evaluated first. The router processes crypto maps in order until a match is found.
Important IOS behavior: The command is available in global config mode, and privilege level 15 is typically required. Changes take effect immediately; the running config is updated. If the crypto map is already applied to an interface, modifying it can cause temporary disruption. The command supports both static and dynamic crypto maps (using `ipsec-isakmp dynamic`). For dynamic crypto maps, the sequence number is used for ordering, but the peer is not specified; instead, the peer is learned during IKE negotiation. A common mistake is forgetting to apply the crypto map to the correct interface, or misconfiguring the ACL such that traffic is not matched. Also, ensure that the transform set and IKE policies are compatible between peers.
crypto map [name] [seq] ipsec-isakmpWhen to Use This Command
- Configuring a site-to-site VPN between two branch offices to securely transmit data over the internet.
- Setting up a remote access VPN for teleworkers to connect to the corporate network.
- Defining multiple crypto map entries with different sequence numbers to support multiple VPN peers or policies.
- Applying a crypto map to an interface to enable IPsec encryption on that interface.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| name | WORD | The name of the crypto map set. This is a user-defined string that identifies the crypto map. Multiple entries can share the same name, differentiated by sequence number. Common mistake: using spaces or special characters; keep it alphanumeric. |
| seq | <1-65535> | The sequence number for this crypto map entry. Lower numbers are evaluated first. Entries are processed in ascending order until a match is found. Common mistake: using duplicate sequence numbers within the same crypto map set; each must be unique. |
| ipsec-isakmp | ipsec-isakmp | Keyword indicating that this crypto map uses IKE to establish IPsec SAs. This is the standard method for site-to-site VPNs. Alternative keywords include `ipsec-manual` (for manual keying) and `dynamic` (for dynamic crypto maps). Common mistake: omitting this keyword or using `ipsec-manual` when IKE is intended. |
Command Examples
Basic site-to-site VPN crypto map
crypto map CMAP 10 ipsec-isakmpcrypto map CMAP 10 ipsec-isakmp
description VPN to Branch Office
set peer 203.0.113.1
set transform-set AES256-SHA
match address 101The crypto map named 'CMAP' with sequence number 10 is created. The 'description' provides a human-readable note. 'set peer' specifies the remote VPN gateway IP. 'set transform-set' defines the encryption and authentication algorithms. 'match address' references an access list that identifies traffic to be encrypted.
Crypto map with multiple peers and PFS
crypto map VPN 20 ipsec-isakmpcrypto map VPN 20 ipsec-isakmp
set peer 198.51.100.1
set peer 198.51.100.2
set transform-set AES128-SHA
set pfs group14
match address 102This crypto map entry has two peers for redundancy. 'set pfs group14' enables Perfect Forward Secrecy using Diffie-Hellman group 14. The transform set uses AES-128 with SHA authentication. Access list 102 defines the interesting traffic.
Understanding the Output
The 'show crypto map' command displays all configured crypto maps. Each entry shows the map name, sequence number, and configuration details. Key fields include: 'description' (optional note), 'set peer' (remote VPN peer IP), 'set transform-set' (encryption and hash algorithms), 'match address' (access list for interesting traffic), and 'set pfs' (PFS group if configured).
A good configuration shows all desired parameters present; missing fields like 'set peer' or 'match address' indicate incomplete setup. Watch for mismatched transform sets or peer IPs that could cause negotiation failures.
Configuration Scenarios
Site-to-Site VPN between Branch and Headquarters
A branch office (R1) needs to securely communicate with the headquarters (R2) over the Internet. All traffic between the 192.168.1.0/24 and 10.10.10.0/24 subnets must be encrypted.
Topology
R1(Gi0/0)---203.0.113.1/30---Internet---203.0.113.2/30---(Gi0/0)R2Steps
- 1.Step 1: Configure IKE policy on both routers.
- 2.Step 2: Define the transform set.
- 3.Step 3: Create an ACL to match interesting traffic.
- 4.Step 4: Create the crypto map referencing the peer, transform set, and ACL.
- 5.Step 5: Apply the crypto map to the outgoing interface.
! On R1 crypto isakmp policy 10 encryption aes 256 authentication pre-share group 14 crypto isakmp key cisco123 address 203.0.113.2 ! crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac ! access-list 100 permit ip 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255 ! crypto map CMAP 10 ipsec-isakmp set peer 203.0.113.2 set transform-set AES256-SHA match address 100 ! interface GigabitEthernet0/0 crypto map CMAP
Verify: Use `show crypto map` to verify the crypto map configuration. Use `show crypto ipsec sa` to see active IPsec SAs. Expected output: the crypto map should show the peer, transform set, and ACL. The IPsec SA should show packets encrypted/decrypted.
Watch out: Forgetting to apply the crypto map to the interface. Also, ensure the ACL is mirrored on both sides (source/destination reversed).
Dynamic Crypto Map for Remote Access VPN
A hub router (R3) needs to accept IPsec connections from multiple remote clients with dynamic IP addresses. The hub uses a dynamic crypto map to allow peers to be learned dynamically.
Topology
R3(Gi0/0)---198.51.100.1/24---Internet---(Dynamic IP) Remote ClientsSteps
- 1.Step 1: Configure IKE policy with a group that clients will use.
- 2.Step 2: Define a transform set.
- 3.Step 3: Create a dynamic crypto map entry (without a peer).
- 4.Step 4: Create a static crypto map that references the dynamic map.
- 5.Step 5: Apply the static crypto map to the interface.
! On R3 crypto isakmp policy 10 encryption aes 256 authentication pre-share group 14 crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 ! crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac ! crypto dynamic-map DYNAMIC 10 set transform-set AES256-SHA ! crypto map CMAP 10 ipsec-isakmp dynamic DYNAMIC ! interface GigabitEthernet0/0 crypto map CMAP
Verify: Use `show crypto map` to see the dynamic map. Use `show crypto session` to see active sessions. Expected output: the dynamic map should appear under the static map. Sessions should show the remote peer IP.
Watch out: The dynamic crypto map must be referenced by a static crypto map. Also, the IKE key must allow any peer (0.0.0.0) or use a group password. Ensure the transform set matches client capabilities.
Troubleshooting with This Command
When troubleshooting IPsec VPNs, the `crypto map` command is often the starting point. Use `show crypto map` to verify that the crypto map is correctly configured and applied to the interface. Healthy output shows the crypto map name, sequence number, peer IP, transform set, ACL, and status (active or not).
If the crypto map is not applied, you'll see 'crypto map not attached' or the interface will be missing. Common problem indicators: 'no peer' or 'peer address not set' for static maps, or 'transform set not set'. If the ACL is misconfigured, the crypto map may not match the intended traffic.
Use `show crypto ipsec sa` to see if SAs are established; if the SA count is zero, the crypto map may not be triggering. Also, check `show crypto isakmp sa` for Phase 1 status. A step-by-step diagnostic flow: 1) Verify crypto map is applied to the correct interface with `show crypto map interface [interface]`. 2) Check that the peer is reachable (ping). 3) Verify IKE phase 1 with `show crypto isakmp sa`; if not established, check IKE policies and pre-shared keys. 4) Check phase 2 with `show crypto ipsec sa`; if no SAs, verify the ACL matches traffic and transform sets are compatible. 5) Use debug commands like `debug crypto ipsec` and `debug crypto isakmp` (with caution) to see negotiation details.
Correlate `show crypto map` output with `show access-lists` to ensure the ACL is permitting the correct traffic. A common symptom is that the crypto map shows 'active' but no traffic is encrypted; this often points to an ACL issue where the traffic is not matched or is matched in the wrong direction. Also, ensure that the crypto map is applied on the interface that faces the remote peer, not on a loopback or internal interface.
CCNA Exam Tips
CCNA exam tip: Crypto map sequence numbers determine the order of evaluation; lower numbers are processed first.
CCNA exam tip: The 'match address' access list must permit the traffic to be encrypted; deny entries are ignored for crypto.
CCNA exam tip: A crypto map must be applied to an interface using 'crypto map [name]' in interface configuration mode to activate IPsec.
CCNA exam tip: For dynamic crypto maps (used in remote access), use 'crypto dynamic-map' instead of 'crypto map'.
Common Mistakes
Mistake 1: Forgetting to apply the crypto map to an interface, resulting in no IPsec encryption despite configuration.
Mistake 2: Using an access list that does not match the actual traffic, causing VPN to not encrypt or to encrypt wrong traffic.
Mistake 3: Configuring mismatched transform sets or IKE policies between peers, leading to negotiation failures.
crypto map [name] [seq] ipsec-isakmp vs crypto isakmp policy [priority]
Both commands are essential for IPsec VPN configurations but operate at different layers: crypto map defines the overall VPN policy including traffic selectors and peer, while ISAKMP policy governs the IKE phase 1 negotiation parameters. They are often confused because they both use policy numbers and are configured under global configuration mode.
| Aspect | crypto map [name] [seq] ipsec-isakmp | crypto isakmp policy [priority] |
|---|---|---|
| Scope | Defines entire IPsec SA (including IKE and transform) | Defines IKE Phase 1 parameters only |
| Function | Associates a transform set, peer, and ACL to the VPN | Sets encryption, hash, authentication, DH group, lifetime for IKE |
| Parameters | ACL, peer IP, transform set, PFS, lifetime | Encryption, hash, authentication, DH group, IKE lifetime |
| Precedence | Sequence number determines match order | Priority number determines preference among policies |
| Relationship | Refers to ISAKMP policy via the transform set and IKE settings | Used as a building block for Phase 1 with the crypto map |
| Typical Use | Applied to an interface with crypto map command | Configured before defining crypto map |
Use crypto map [name] [seq] ipsec-isakmp when you need to configure the overall IPsec VPN entry, specifying the traffic to encrypt, the peer, and the security parameters.
Use crypto isakmp policy [priority] when you need to define the IKE Phase 1 parameters such as encryption, authentication, and Diffie-Hellman group for the VPN negotiations.
Platform Notes
In IOS-XE (e.g., 16.x and later), the `crypto map` command syntax is identical to classic IOS, but the output of `show crypto map` may include additional fields like 'IPsec profile' or 'tunnel protection'. IOS-XE also supports the `crypto map` command in the same way, but there is a trend toward using tunnel protection with IPsec profiles for simplicity. For NX-OS (Cisco Nexus switches), the equivalent is `crypto map` as well, but the configuration is done under a feature called 'feature crypto' and the syntax is similar: `crypto map [name] [seq] ipsec-isakmp`.
However, NX-OS uses a different IKE configuration (e.g., `crypto ikev2` instead of `crypto isakmp`). On Cisco ASA, the equivalent is `crypto map` but with different parameters; for example, `crypto map [name] [seq] match address [acl]` and `crypto map [name] [seq] set peer [ip]`. ASA also uses `crypto ipsec transform-set` similarly.
For IOS-XR, the command is not directly available; instead, IPsec is configured using a different model with `crypto ikev2` and `crypto ipsec` profiles. In terms of version differences, IOS 12.x and 15.x behave similarly, but 15.x introduced support for IKEv2 and additional transform sets. Always check the specific platform documentation for exact syntax and capabilities.
Related Commands
crypto ipsec transform-set [name] esp-aes esp-sha-hmac
Defines an IPsec transform set specifying the encryption and authentication algorithms to protect VPN traffic, used when configuring an IPsec VPN policy.
crypto isakmp policy [priority]
Creates or modifies an ISAKMP (IKE) policy for IPsec VPN negotiations, defining encryption, authentication, and key exchange parameters.
show crypto map
Displays the configured crypto map entries, including their match criteria, peer addresses, and transform sets, used to verify IPsec VPN policy configuration.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions