Courseiva
VPNInterface Config

crypto map [name]

The crypto map command in interface configuration mode applies a previously defined crypto map set to a router interface, enabling IPsec VPN encryption and decryption on that interface.

Definition: crypto map [name] is a Cisco IOS interface config command. The crypto map command in interface configuration mode applies a previously defined crypto map set to a router interface, enabling IPsec VPN encryption and decryption on that interface.

Overview

The crypto map command in interface configuration mode is a critical tool for applying IPsec VPN policies to a router interface. It binds a previously defined crypto map set—which specifies encryption, authentication, and key management parameters—to a physical or logical interface, enabling the router to encrypt outbound traffic and decrypt inbound traffic for secure communication over an untrusted network like the Internet. This command is essential for site-to-site VPNs, remote access VPNs, and any scenario where data confidentiality and integrity are required across a public or private WAN.

The underlying concept is that a crypto map defines a set of transform sets, peer addresses, and access lists that classify which traffic should be protected; applying it to an interface activates these policies for all traffic traversing that interface. Network engineers reach for this command when configuring IPsec on Cisco routers, typically after defining the crypto map globally. Alternatives include using tunnel interfaces with IPsec profiles (more common in modern designs) or DMVPN, but crypto maps remain widely used for simple site-to-site VPNs.

In the broader workflow, crypto map configuration follows IKE phase 1 setup (isakmp policy) and phase 2 transform sets; it is applied after the crypto map is defined globally. Important IOS behaviors: the command is available in privileged EXEC mode (enable) and interface configuration mode; it modifies the running configuration immediately; multiple crypto maps can be applied to the same interface (with sequence numbers) for failover or load balancing; the command requires that the crypto map set already exists in the global configuration. Buffered output is not directly affected, but show commands like 'show crypto map' display the applied configuration.

Privilege level 15 is typically required to configure this command. This command is a cornerstone of IPsec VPN deployment on Cisco IOS and is frequently tested in CCNA and CCNP exams.

Syntax·Interface Config
crypto map [name]

When to Use This Command

  • Apply a site-to-site VPN crypto map to the outside interface of a branch router to secure traffic to the main office.
  • Attach a crypto map to a tunnel interface for a DMVPN configuration.
  • Apply a dynamic crypto map to a router interface to allow remote access VPN clients to initiate connections.
  • Remove a crypto map from an interface when decommissioning a VPN tunnel.

Parameters

ParameterSyntaxDescription
nameWORDThe name of the crypto map set to apply. This must match a crypto map defined globally using 'crypto map [name] [seq-num] [type]'. Common mistake: using a name that does not exist, which results in an error. The name is case-sensitive and can be alphanumeric.

Command Examples

Apply a static crypto map to an interface

interface GigabitEthernet0/0 crypto map MYVPN_MAP
GigabitEthernet0/0 is up, line protocol is up
  Hardware is ISR4321, address is aaaa.bbbb.cccc (bia aaaa.bbbb.cccc)
  Internet address is 203.0.113.1/24
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Crypto map: MYVPN_MAP
  ...

The output shows the interface configuration. The line 'Crypto map: MYVPN_MAP' confirms the crypto map is applied. No errors indicate successful application.

Remove a crypto map from an interface

interface GigabitEthernet0/0 no crypto map MYVPN_MAP
GigabitEthernet0/0 is up, line protocol is up
  Hardware is ISR4321, address is aaaa.bbbb.cccc (bia aaaa.bbbb.cccc)
  Internet address is 203.0.113.1/24
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  ...

After the 'no crypto map' command, the 'Crypto map' line disappears from the interface output, indicating the map is no longer applied.

Understanding the Output

When you apply a crypto map to an interface, the interface configuration output (via 'show running-config interface' or 'show interfaces') will include a line indicating the crypto map name. This confirms that IPsec processing is enabled on that interface. If the crypto map is not applied, that line will be absent.

In production, you can verify with 'show crypto map' to see active maps and their status. A missing crypto map on the expected interface means VPN traffic will not be encrypted/decrypted, leading to connectivity issues.

Configuration Scenarios

Site-to-Site VPN between two branch routers

Two branch offices need to communicate securely over the Internet. Each router has a public IP on its WAN interface. A crypto map is used to encrypt traffic between the two LAN subnets.

Topology

Branch1(R1) Gi0/0 (203.0.113.1)---Internet---(203.0.113.2) Gi0/0 Branch2(R2) Branch1 LAN: 192.168.1.0/24 Branch2 LAN: 192.168.2.0/24

Steps

  1. 1.Step 1: Configure IKE phase 1 policy on both routers: Router(config)# crypto isakmp policy 10
  2. 2.Step 2: Define transform set for phase 2: Router(config)# crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac
  3. 3.Step 3: Create an access list to match interesting traffic: Router(config)# access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
  4. 4.Step 4: Define the crypto map globally: Router(config)# crypto map CMAP 10 ipsec-isakmp
  5. 5.Step 5: Set the peer IP: Router(config-crypto-map)# set peer 203.0.113.2
  6. 6.Step 6: Set the transform set: Router(config-crypto-map)# set transform-set ESP-AES256-SHA
  7. 7.Step 7: Match the access list: Router(config-crypto-map)# match address 100
  8. 8.Step 8: Exit and apply the crypto map to the WAN interface: Router(config)# interface GigabitEthernet0/0
  9. 9.Step 9: Apply the crypto map: Router(config-if)# crypto map CMAP
Configuration
! Branch1 configuration
crypto isakmp policy 10
 authentication pre-share
 encryption aes 256
 hash sha
 group 5
 lifetime 86400
crypto isakmp key cisco123 address 203.0.113.2
!
crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
!
crypto map CMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set ESP-AES256-SHA
 match address 100
!
interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.252
 crypto map CMAP

Verify: show crypto map show crypto ipsec sa Expected output: 'show crypto map' should display the applied crypto map on Gi0/0. 'show crypto ipsec sa' should show active IPsec SAs with packet encrypt/decrypt counts.

Watch out: Forgetting to configure the ISAKMP key on both routers with matching pre-shared keys. The key must be identical; otherwise, IKE negotiation fails.

Dynamic crypto map for remote access VPN

A central office router needs to accept IPsec connections from multiple remote users with dynamic IP addresses. A dynamic crypto map allows the router to negotiate with unknown peers without specifying a static peer IP.

Topology

Central Router R1 Gi0/0 (203.0.113.1)---Internet---Remote Users (dynamic IPs) Central LAN: 10.0.0.0/24

Steps

  1. 1.Step 1: Create a dynamic crypto map: Router(config)# crypto dynamic-map DYN-MAP 10
  2. 2.Step 2: Set transform set: Router(config-crypto-map)# set transform-set ESP-AES256-SHA
  3. 3.Step 3: Optionally match an access list: Router(config-crypto-map)# match address 101
  4. 4.Step 4: Exit and create a static crypto map that references the dynamic map: Router(config)# crypto map STATIC-MAP 10 ipsec-isakmp dynamic DYN-MAP
  5. 5.Step 5: Apply the static crypto map to the WAN interface: Router(config)# interface GigabitEthernet0/0
  6. 6.Step 6: Apply: Router(config-if)# crypto map STATIC-MAP
Configuration
! Central router configuration
crypto isakmp policy 10
 authentication pre-share
 encryption aes 256
 hash sha
 group 5
 lifetime 86400
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac
!
access-list 101 permit ip 10.0.0.0 0.0.0.255 any
!
crypto dynamic-map DYN-MAP 10
 set transform-set ESP-AES256-SHA
 match address 101
!
crypto map STATIC-MAP 10 ipsec-isakmp dynamic DYN-MAP
!
interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.0
 crypto map STATIC-MAP

Verify: show crypto map show crypto ipsec sa Expected output: 'show crypto map' should show the dynamic map template. 'show crypto ipsec sa' should show SAs for each connected remote peer.

Watch out: The dynamic crypto map must be referenced by a static crypto map; it cannot be applied directly to an interface. Also, ensure the ISAKMP key uses 0.0.0.0 to accept any peer.

Troubleshooting with This Command

When troubleshooting IPsec VPNs, the 'show crypto map' command is the first step to verify that the crypto map is correctly applied to the interface. A healthy output shows the crypto map name, sequence number, interface it is applied to, peer IP, transform set, and access list. Problem indicators include: 'crypto map not attached' (meaning the command was not applied), 'no peer' (if set peer is missing), or 'transform set not found' (if the referenced transform set does not exist).

Focus on the 'Interface:' field—if it shows 'None', the map is not applied. Also check the 'Peer:' field; if it is '0.0.0.0' for a static map, the peer is missing. Common symptoms: VPN tunnel does not come up; 'show crypto ipsec sa' shows no SAs.

In such cases, use 'show crypto map' to confirm the configuration. A step-by-step diagnostic flow: 1) Run 'show crypto map' on the router. 2) Verify the interface is correct. 3) Check that the peer IP matches the remote router's public IP. 4) Ensure the access list matches the desired traffic. 5) If using dynamic maps, confirm the dynamic map is properly referenced. 6) Correlate with 'show crypto isakmp sa' to check IKE phase 1 status. If IKE is down, the crypto map may be correct but the pre-shared key or policy mismatches.

Also use 'debug crypto ipsec' and 'debug crypto isakmp' to see negotiation details. For example, if 'show crypto map' shows the map is applied but 'show crypto ipsec sa' shows no SAs, the issue is likely in IKE or IPsec parameters. The output of 'show crypto map' also displays the 'Security Association Lifetime' and 'PFS' settings, which must match between peers.

If the tunnel is up but traffic is not encrypted, check the access list—it might be too restrictive or misordered. Remember that 'show crypto map' only shows the configuration; actual traffic encryption is verified with 'show crypto ipsec sa' packet counters.

CCNA Exam Tips

1.

CCNA exam tip: Remember that crypto maps are applied in interface configuration mode, not globally.

2.

CCNA exam tip: You can only apply one crypto map per interface; if you need multiple policies, use a crypto map set with multiple map entries.

3.

CCNA exam tip: The 'no crypto map' command removes the map from the interface but does not delete the crypto map definition itself.

4.

CCNA exam tip: For dynamic crypto maps (used with IKEv1), you apply them the same way, but they are typically used for remote access VPNs.

Common Mistakes

Mistake 1: Applying the crypto map in global configuration mode instead of interface configuration mode — results in error 'Invalid input detected'.

Mistake 2: Forgetting to apply the crypto map to the correct interface (e.g., applying to inside LAN interface instead of outside WAN interface) — VPN traffic will not be encrypted.

Mistake 3: Applying a crypto map that references an invalid or missing transform set or peer — the interface will accept the command but IPsec will fail to establish.

crypto map [name] vs crypto map [name] [seq] ipsec-isakmp

The commands 'crypto map [name]' (interface config) and 'crypto map [name] [seq] ipsec-isakmp' (global config) are often confused because both involve crypto map configuration but serve distinct roles: one applies a crypto map set to an interface, while the other defines the crypto map entry itself. Understanding the difference is crucial for correct VPN deployment.

Aspectcrypto map [name]crypto map [name] [seq] ipsec-isakmp
ScopeApplies an entire crypto map set to an interfaceDefines a single crypto map entry globally
Configuration modeInterface configuration modeGlobal configuration mode
PersistenceEffective only while applied to the interface; can be removed with 'no crypto map'Persists in running-config as part of the crypto map definition
PrecedenceUses the entire map set; interface selects one set by nameThe sequence number determines priority within the map set
Typical useEnabling IPsec on a specific interfaceConfiguring security policies, peers, and transform sets

Use crypto map [name] when you have already defined a crypto map set and need to activate it on a router interface for VPN traffic.

Use crypto map [name] [seq] ipsec-isakmp when you need to create a new crypto map entry or modify an existing one to define IPsec parameters like encryption, authentication, and peer.

Platform Notes

In IOS-XE (e.g., CSR1000v, ISR 4000 series), the 'crypto map' command syntax and behavior are identical to classic IOS. However, IOS-XE supports additional features like 'crypto map [name] [seq] ipsec-isakmp' with 'set security-association level per-host' for advanced configurations. Output formatting in 'show crypto map' may differ slightly (e.g., line breaks).

In NX-OS (Cisco Nexus switches), the equivalent command is 'crypto map [name]' applied under interface configuration, but NX-OS uses a different VPN architecture (e.g., 'feature ipsec' must be enabled first). The NX-OS syntax is similar: 'interface ethernet 1/1; crypto map CMAP'. However, NX-OS does not support dynamic crypto maps; instead, use 'crypto ikev2' profiles.

On Cisco ASA firewalls, the equivalent is 'crypto map [name] [seq] match address [acl]' and 'crypto map [name] [seq] set peer [ip]', applied with 'crypto map [name] interface [if_name]'. ASA syntax is distinct but conceptually similar. In IOS-XR (Cisco ASR 9000, NCS 5500), the 'crypto map' command is not used; instead, IPsec is configured using 'crypto ipsec profile' and 'interface tunnel-ip' with 'ipv4 ipsec profile'.

IOS versions: In 12.x, crypto maps were the primary method; 15.x introduced IPsec profiles but crypto maps remain supported. 16.x (IOS-XE) maintains backward compatibility. Always check the specific platform documentation for exact syntax.

Related Commands

crypto ipsec transform-set [name] esp-aes esp-sha-hmac

Defines an IPsec transform set specifying the encryption and authentication algorithms to protect VPN traffic, used when configuring an IPsec VPN policy.

crypto isakmp policy [priority]

Creates or modifies an ISAKMP (IKE) policy for IPsec VPN negotiations, defining encryption, authentication, and key exchange parameters.

crypto map [name] [seq] ipsec-isakmp

Creates or modifies a crypto map entry for IPsec VPN configuration, defining the security policies and peer parameters for IKE and IPsec negotiations.

show crypto map

Displays the configured crypto map entries, including their match criteria, peer addresses, and transform sets, used to verify IPsec VPN policy configuration.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions