match address [acl]
Associates an IP access list with a crypto map entry to define which traffic should be encrypted and sent over the VPN tunnel.
Definition: match address [acl] is a Cisco IOS crypto map config command. Associates an IP access list with a crypto map entry to define which traffic should be encrypted and sent over the VPN tunnel.
Overview
The `match address [acl]` command in crypto map configuration mode is a fundamental building block of IPsec VPN configuration on Cisco IOS devices. It associates a specific IP access list (ACL) with a crypto map entry, thereby defining which traffic should be encrypted and sent over the VPN tunnel. Without this command, the crypto map would have no traffic selection criteria, and no packets would be protected.
The ACL acts as a traffic selector: packets matching permit statements in the ACL are subject to IPsec encryption (or decryption, depending on the direction), while packets denied by the ACL are forwarded in the clear. This command is critical for site-to-site VPNs, remote-access VPNs, and any scenario where you need to selectively encrypt traffic between networks. The underlying concept is that IPsec policies are applied to traffic flows, not interfaces; the ACL defines the flow.
Alternatives include using route-based VPNs (e.g., VTI) where traffic selection is done via routing, but `match address` remains the classic approach for policy-based VPNs. In the broader configuration workflow, you first define the ACL, then create a transform set, then configure the crypto map (including the peer, transform set, and this match command), and finally apply the crypto map to an interface. Important IOS behavior: the ACL must be a standard or extended named/numbered ACL; only permit statements matter (deny statements simply exclude traffic from encryption).
The command is available in global configuration mode after entering crypto map configuration. It does not require any special privilege level beyond 15. Changes take effect immediately on the running config, but existing IPsec security associations (SAs) may need to be cleared to renegotiate with new selectors.
A common mistake is using an ACL that is too broad or too narrow, causing traffic to be dropped or sent in clear. Also, the ACL should be mirrored on the peer (source/destination reversed) for proper negotiation. This command is the heart of policy-based VPN configuration and is tested heavily in CCNA and CCNP security exams.
match address [acl]When to Use This Command
- Encrypt traffic from the 10.1.1.0/24 subnet to the 192.168.1.0/24 subnet over a site-to-site VPN.
- Selectively encrypt only specific traffic types (e.g., HTTP, HTTPS) while allowing other traffic to pass in plaintext.
- Define multiple crypto map entries with different access lists to support multiple VPN peers or different encryption policies.
- Update an existing crypto map to change the traffic selection criteria without affecting other VPN parameters.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| acl | <1-199> | <1300-2699> | WORD | Specifies the access list number or name that defines the traffic to be encrypted. Valid values are standard ACL numbers (1-99, 1300-1999), extended ACL numbers (100-199, 2000-2699), or a named ACL (WORD). The ACL must contain permit statements for the traffic you want to protect. Common mistakes include using an ACL that is not configured, using a named ACL that doesn't exist, or forgetting to mirror the ACL on the peer (source/destination reversed). |
Command Examples
Basic ACL assignment to a crypto map
match address VPN-ACLcrypto map CMAP 10 ipsec-isakmp match address VPN-ACL set peer 192.168.2.1 set transform-set TSET
The 'match address VPN-ACL' command ties the access list named VPN-ACL to crypto map entry 10. Only traffic matching VPN-ACL will be encrypted and sent to peer 192.168.2.1 using transform set TSET.
Using a numbered ACL in crypto map
match address 101crypto map MYMAP 20 ipsec-isakmp match address 101 set peer 10.0.0.2 set transform-set AES256-SHA
Here, extended access list 101 is referenced. The output shows that traffic matching ACL 101 will be encrypted and sent to peer 10.0.0.2 using the AES256-SHA transform set.
Understanding the Output
When you issue 'show crypto map', the output displays each crypto map entry with its associated match address. The 'match address' line shows the ACL name or number. If the ACL is misconfigured or missing, the crypto map will not encrypt any traffic.
A correctly configured entry will show the ACL name and the crypto map will be active. Look for 'ipsec-isakmp' to confirm the map is for IPsec. If the ACL is empty or permits all, unintended traffic may be encrypted or bypassed.
Configuration Scenarios
Site-to-Site VPN between Branch and HQ
A branch office (192.168.1.0/24) needs to securely communicate with the HQ network (10.10.10.0/24) over the internet. A site-to-site IPsec VPN is required using a crypto map.
Topology
Branch(R1-Gi0/0)---Internet---(Gi0/0)R2-HQ
Branch LAN: 192.168.1.0/24
HQ LAN: 10.10.10.0/24
Public IPs: Branch 203.0.113.1, HQ 198.51.100.1Steps
- 1.Step 1: Configure the ACL on Branch to match traffic from Branch LAN to HQ LAN: R1(config)# access-list 100 permit ip 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255
- 2.Step 2: Create an IKE policy (isakmp policy) for Phase 1: R1(config)# crypto isakmp policy 10; R1(config-isakmp)# authentication pre-share; R1(config-isakmp)# encryption aes 256; R1(config-isakmp)# hash sha; R1(config-isakmp)# group 5
- 3.Step 3: Configure the pre-shared key for the peer: R1(config)# crypto isakmp key cisco123 address 198.51.100.1
- 4.Step 4: Create an IPsec transform set: R1(config)# crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
- 5.Step 5: Create the crypto map and associate the ACL: R1(config)# crypto map CMAP 10 ipsec-isakmp; R1(config-crypto-map)# set peer 198.51.100.1; R1(config-crypto-map)# set transform-set TSET; R1(config-crypto-map)# match address 100
- 6.Step 6: Apply the crypto map to the outgoing interface: R1(config)# interface GigabitEthernet0/0; R1(config-if)# crypto map CMAP
! Branch Router R1 access-list 100 permit ip 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255 ! crypto isakmp policy 10 authentication pre-share encryption aes 256 hash sha group 5 ! crypto isakmp key cisco123 address 198.51.100.1 ! crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac ! crypto map CMAP 10 ipsec-isakmp set peer 198.51.100.1 set transform-set TSET match address 100 ! interface GigabitEthernet0/0 crypto map CMAP
Verify: Use 'show crypto map' to verify the crypto map configuration and 'show crypto ipsec sa' to see active security associations. Expected output for 'show crypto map': Crypto Map "CMAP" 10 ipsec-isakmp Peer = 198.51.100.1 Extended IP access list 100 access-list 100 permit ip 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255 Current peer: 198.51.100.1 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={TSET,}
Watch out: A common mistake is forgetting to mirror the ACL on the HQ router. The HQ ACL should be: access-list 100 permit ip 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255. If the ACLs are not mirrored, IPsec negotiation will fail.
Remote Access VPN with Dynamic Crypto Map
A remote access VPN allows multiple mobile users to connect to the corporate network (10.10.10.0/24). Since the remote clients have dynamic IP addresses, a dynamic crypto map is used with a static ACL to match traffic from any client to the corporate LAN.
Topology
Remote Clients (dynamic IPs)---Internet---(Gi0/0)R2-Corporate
Corporate LAN: 10.10.10.0/24
R2 Public IP: 198.51.100.1Steps
- 1.Step 1: Create an ACL that matches traffic from any source to the corporate LAN: R2(config)# access-list 101 permit ip any 10.10.10.0 0.0.0.255
- 2.Step 2: Configure IKE policy and pre-shared key (using a wildcard peer for dynamic): R2(config)# crypto isakmp policy 10; R2(config-isakmp)# authentication pre-share; R2(config-isakmp)# encryption aes 256; R2(config-isakmp)# hash sha; R2(config-isakmp)# group 5; R2(config)# crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
- 3.Step 3: Create transform set: R2(config)# crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
- 4.Step 4: Create a dynamic crypto map: R2(config)# crypto dynamic-map DYN_MAP 10; R2(config-crypto-dynamic-map)# set transform-set TSET; R2(config-crypto-dynamic-map)# match address 101
- 5.Step 5: Create a static crypto map that references the dynamic map: R2(config)# crypto map CMAP 10 ipsec-isakmp dynamic DYN_MAP
- 6.Step 6: Apply the crypto map to the outside interface: R2(config)# interface GigabitEthernet0/0; R2(config-if)# crypto map CMAP
! Corporate Router R2 access-list 101 permit ip any 10.10.10.0 0.0.0.255 ! crypto isakmp policy 10 authentication pre-share encryption aes 256 hash sha group 5 ! crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 ! crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac ! crypto dynamic-map DYN_MAP 10 set transform-set TSET match address 101 ! crypto map CMAP 10 ipsec-isakmp dynamic DYN_MAP ! interface GigabitEthernet0/0 crypto map CMAP
Verify: Use 'show crypto dynamic-map' to verify the dynamic map and 'show crypto map' to see the static map referencing it. For active connections, use 'show crypto ipsec sa'. Expected output for 'show crypto dynamic-map': Dynamic crypto map "DYN_MAP" 10 Extended IP access list 101 access-list 101 permit ip any 10.10.10.0 0.0.0.255 Transform sets={TSET,}
Watch out: A common mistake is using a specific peer address in the dynamic map; dynamic maps must not have a set peer command. Also, ensure the ACL is broad enough to match all remote clients (any source).
Troubleshooting with This Command
When troubleshooting VPN connectivity issues, the `match address` command is often the first place to look. A healthy configuration shows the correct ACL associated with the crypto map, and the ACL should have permit statements that exactly match the desired traffic flows. Problem indicators include: no traffic being encrypted (packets dropped or sent in clear), IPsec SAs not forming, or mismatched ACLs between peers.
Key fields to focus on in `show crypto map` output are the 'Extended IP access list' line and the list of permit entries. If the ACL is missing or incorrect, the crypto map will not select any traffic. Common symptoms: if the ACL is too restrictive (e.g., missing a subnet), some traffic will bypass encryption; if too broad, unintended traffic may be encrypted or dropped.
Another symptom is 'no matching ACL entry' in debug logs. Step-by-step diagnostic flow: 1) Verify the crypto map is applied to the correct interface with `show crypto map interface [interface]`. 2) Check the ACL with `show access-lists [acl]` to ensure permit entries exist and hit counts are incrementing. 3) Use `show crypto ipsec sa` to see if SAs are active; if not, check `debug crypto ipsec` and `debug crypto isakmp` for negotiation errors. Correlate the ACL hit counts with the crypto map: if hits are increasing but no SAs form, the issue is likely Phase 1 or Phase 2 parameters.
If hits are zero, traffic is not matching the ACL. Also, verify that the ACL on the peer is mirrored (source/destination reversed). A common mistake is using an ACL with the same source/destination on both ends, which causes IPsec to fail because the selectors don't match.
In summary, the `match address` command is the traffic selector; ensuring it is correctly defined and mirrored is essential for VPN operation.
CCNA Exam Tips
Remember that the ACL must be an extended access list; standard ACLs are not supported for crypto maps.
The ACL is used to identify interesting traffic that triggers IKE phase 2 and is encrypted; traffic not matching the ACL is sent in clear text.
On the CCNA exam, you may be asked to configure a crypto map and apply the correct ACL; ensure the ACL permits only the desired traffic and denies all else.
Be aware that the same ACL can be used in multiple crypto map entries, but each entry must have a unique sequence number.
Common Mistakes
Using a standard ACL instead of an extended ACL, which will cause the crypto map to fail to match traffic.
Forgetting to include a deny statement at the end of the ACL, causing unintended traffic to be encrypted.
Applying the crypto map to the wrong interface or not applying it at all, resulting in no encryption.
match address [acl] vs crypto map [name] [seq] ipsec-isakmp
Both commands are integral to IPsec VPN configuration, but they operate at different layers. The 'match address' command associates a crypto map entry with an access list to define interesting traffic, while the 'crypto map' command creates the crypto map entry itself, specifying IPsec parameters and peers. They are commonly confused because both appear in the same crypto map configuration context.
| Aspect | match address [acl] | crypto map [name] [seq] ipsec-isakmp |
|---|---|---|
| Scope | Single crypto map entry | Entire crypto map entry creation |
| Configuration mode | Crypto map config mode | Global config mode (enters crypto map config) |
| Persistence | Stored within crypto map entry | Crypto map entry stored in running config |
| Precedence | Part of the crypto map; order matters for matching | Defines the entry; order among entries matters |
| Typical use | Ties ACL to encryption for specific traffic | Initiates IPsec SA negotiation with peer |
Use match address [acl] when you need to specify which traffic (via an access list) should be encrypted and protected by the VPN tunnel defined in the crypto map entry.
Use crypto map [name] [seq] ipsec-isakmp when you are creating or editing a crypto map entry to define IPsec security policies, transform sets, peer address, and other parameters for IKE and IPsec negotiations.
Platform Notes
On IOS-XE (e.g., CSR1000v, ISR 4000 series), the `match address` command syntax is identical to classic IOS. However, IOS-XE may support additional features like VRF-aware IPsec, but the command itself remains unchanged. The output of `show crypto map` is similar but may include additional fields like 'Reverse Route Injection' status.
On NX-OS (e.g., Nexus 7000, 9000), the equivalent command is `match address` within the crypto map configuration, but NX-OS uses a different configuration hierarchy: you first create an IPsec policy with `crypto ipsec policy` and then apply it to a crypto map. The exact syntax is `match address [acl]` under `crypto map [name] [seq] ipsec`. NX-OS also supports IPv6 ACLs.
On ASA firewalls, the equivalent is `access-list [acl] extended permit ip [src] [dst]` and then `crypto map [name] [seq] match address [acl]`. The ASA syntax is very similar. For IOS-XR (e.g., ASR 9000), the command is `match address [acl]` under `crypto map` configuration, but IOS-XR uses a different configuration mode (crypto map configuration is entered via `crypto map [name] [seq]`).
There are no major differences in behavior across IOS versions 12.x, 15.x, and 16.x for this command, but newer versions may support additional ACL types (e.g., named ACLs with IPv6). Always ensure the ACL is configured before referencing it in the crypto map.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions