Courseiva
VPNCrypto Map Config

set peer [ip]

Specifies the IP address of the remote VPN peer for an IPsec crypto map entry, defining the endpoint for the VPN tunnel.

Definition: set peer [ip] is a Cisco IOS crypto map config command. Specifies the IP address of the remote VPN peer for an IPsec crypto map entry, defining the endpoint for the VPN tunnel.

Overview

The `set peer` command in crypto map configuration mode is a fundamental building block for establishing IPsec VPN tunnels on Cisco IOS routers. It specifies the IP address of the remote VPN peer, which is the endpoint of the encrypted tunnel. This command is essential because it tells the router where to send encrypted traffic and with whom to negotiate security associations (SAs).

Without a peer address, the crypto map cannot initiate or respond to IPsec negotiations. The command is used in the context of site-to-site VPNs, where two trusted networks communicate over an untrusted medium like the internet. It is typically applied after defining an ISAKMP policy (IKE phase 1) and before setting transform sets and ACLs.

The `set peer` command is part of the crypto map configuration, which is then applied to an interface. Alternatives include using dynamic crypto maps for dial-on-demand or unknown peers, but static peers are preferred for fixed site-to-site links. In the broader workflow, you first configure IKE policies, then define the crypto map with `set peer`, `set transform-set`, and `match address` (for interesting traffic).

The command takes effect immediately when applied to the interface, but the actual tunnel only comes up when interesting traffic triggers it. The running config stores the peer address, and it can be viewed with `show crypto map`. Privilege level 15 is required.

A common mistake is using an incorrect IP address or forgetting to apply the crypto map to the interface, which results in no tunnel establishment.

Syntax·Crypto Map Config
set peer [ip]

When to Use This Command

  • Configuring a site-to-site VPN between two branch offices where each router needs to know the peer's public IP.
  • Setting up a remote access VPN where the headend router specifies the peer IP of the remote client or another gateway.
  • Defining multiple peers for redundancy in a VPN configuration by using multiple crypto map entries with different peer IPs.
  • Changing the peer IP address when the remote endpoint's IP changes due to ISP reconfiguration.

Parameters

ParameterSyntaxDescription
ipA.B.C.DThe IP address of the remote VPN peer. This must be a valid IPv4 address reachable from the local router. Common mistakes include using a private IP that is not routable over the internet, or a typo in the address. Ensure the peer is reachable via ping before configuring.

Command Examples

Basic peer assignment for site-to-site VPN

set peer 203.0.113.5

This command sets the remote VPN peer IP address to 203.0.113.5. No output is displayed upon successful configuration. Use 'show crypto map' to verify.

Verifying peer configuration in crypto map

show crypto map
Crypto Map "MYMAP" 10 ipsec-isakmp
    Peer = 203.0.113.5
    Extended IP access list 101
        access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
    Current peer: 203.0.113.5
    Security association lifetime: 4608000 kilobytes/3600 seconds
    PFS (Y/N): N
    Transform sets={ TS1, }
    Interfaces using crypto map MYMAP: GigabitEthernet0/0

The output shows the crypto map 'MYMAP' with sequence 10. 'Peer = 203.0.113.5' confirms the configured peer. 'Current peer' indicates the active peer. The ACL defines traffic to protect. Lifetime and transform sets are also displayed.

Understanding the Output

The 'set peer' command itself produces no output. To verify, use 'show crypto map'. The output lists each crypto map entry with its sequence number, peer IP, ACL, lifetime, PFS setting, transform sets, and interfaces.

The 'Peer' field shows the configured remote IP. 'Current peer' indicates the active peer if multiple are configured. A missing peer or incorrect IP means the VPN will not establish.

Ensure the peer IP is reachable and matches the remote device's configuration.

Configuration Scenarios

Site-to-Site VPN between Branch and Headquarters

A branch office (Branch) needs to securely communicate with the headquarters (HQ) over the internet. Both routers have public IP addresses on their WAN interfaces.

Topology

Branch(Gi0/1)---203.0.113.1/30---Internet---203.0.113.2/30---(Gi0/1)HQ

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Configure IKE policy: crypto isakmp policy 10, encryption aes 256, hash sha, authentication pre-share, group 14
  3. 3.Step 3: Configure pre-shared key: crypto isakmp key cisco123 address 203.0.113.2
  4. 4.Step 4: Configure transform set: crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac
  5. 5.Step 5: Create access list for interesting traffic: access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
  6. 6.Step 6: Create crypto map: crypto map CMAP 10 ipsec-isakmp
  7. 7.Step 7: Set peer: set peer 203.0.113.2
  8. 8.Step 8: Set transform set: set transform-set TS
  9. 9.Step 9: Match address: match address 100
  10. 10.Step 10: Apply crypto map to WAN interface: interface GigabitEthernet0/1, crypto map CMAP
Configuration
! Branch Router Configuration
crypto isakmp policy 10
 encryption aes 256
 hash sha
 authentication pre-share
 group 14
crypto isakmp key cisco123 address 203.0.113.2
!
crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac
!
access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
!
crypto map CMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set TS
 match address 100
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.252
 crypto map CMAP

Verify: show crypto map: verify peer address is 203.0.113.2 and state is 'ipsec-isakmp'. show crypto ipsec sa: verify that inbound and outbound SAs are active (encapsulation and decapsulation counters increment).

Watch out: Forgetting to apply the crypto map to the correct interface. The crypto map must be applied to the interface that has the route to the peer. Also, ensure the ACL matches traffic in both directions (mirror image on the peer).

VPN with Multiple Peers for Redundancy

A central site (HQ) has two internet connections for redundancy. It needs to establish VPN tunnels to a remote branch using either peer IP, with failover if one goes down.

Topology

HQ(Gi0/1)---198.51.100.1/30---ISP1---Branch(Gi0/1)---203.0.113.1/30---ISP2---HQ(Gi0/2)---198.51.100.5/30

Steps

  1. 1.Step 1: Configure IKE policies and pre-shared keys for both peers.
  2. 2.Step 2: Create a crypto map entry with multiple set peer commands (order matters for priority).
  3. 3.Step 3: Apply the same crypto map to both WAN interfaces (or use different crypto maps).
  4. 4.Step 4: Ensure routing directs traffic appropriately.
Configuration
! HQ Router
crypto isakmp policy 10
 encryption aes 256
 hash sha
 authentication pre-share
 group 14
crypto isakmp key cisco123 address 203.0.113.1
crypto isakmp key cisco123 address 198.51.100.2
!
crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac
!
access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
!
crypto map CMAP 10 ipsec-isakmp
 set peer 203.0.113.1
 set peer 198.51.100.2
 set transform-set TS
 match address 100
!
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.252
 crypto map CMAP
!
interface GigabitEthernet0/2
 ip address 198.51.100.5 255.255.255.252
 crypto map CMAP

Verify: show crypto map: verify both peers are listed. show crypto ipsec sa peer 203.0.113.1: check SA status. Simulate failure by shutting down one interface and verify failover to the other peer.

Watch out: The order of set peer commands determines priority. The first peer is primary; if it fails, the router tries the next. Ensure that the crypto map is applied to both interfaces; otherwise, the backup peer may not be reachable.

Troubleshooting with This Command

When troubleshooting a VPN that uses the `set peer` command, start by verifying that the peer address is correct and reachable. Use `ping` from the router to the peer IP to confirm Layer 3 connectivity. If ping fails, check routing and ACLs that might block ICMP.

Next, examine the crypto map configuration with `show crypto map`. Look for the peer address under the map entry; if it's missing or incorrect, re-enter the command. Also verify that the crypto map is applied to the correct interface (the one with the route to the peer).

Use `show crypto isakmp sa` to check IKE phase 1 status. A state of 'MM_NO_STATE' indicates no negotiation; 'MM_ACTIVE' means phase 1 is up. If phase 1 is down, check ISAKMP policy and pre-shared keys.

For phase 2, use `show crypto ipsec sa`. Look for 'encaps' and 'decaps' counters; if they are zero, no traffic is being encrypted. Check the ACL with `show access-lists` to ensure interesting traffic matches.

Common symptoms: 'set peer' configured but no tunnel – often due to missing crypto map on interface or incorrect ACL. Another symptom: tunnel comes up but traffic not encrypted – verify that the ACL matches the actual traffic flows. Use `debug crypto ipsec` and `debug crypto isakmp` with caution in production.

Correlate `show crypto map` output with `show ip route` to ensure the peer is reachable via the correct interface. If multiple peers are configured, `show crypto map` shows the active peer. If the primary peer fails, the router will attempt the next peer; check `show crypto ipsec sa` for the peer address to confirm which is active.

CCNA Exam Tips

1.

Remember that 'set peer' is configured in crypto map config mode, not global config.

2.

The peer IP must be the public IP of the remote VPN device; private IPs are used only if both endpoints are on the same network.

3.

You can configure multiple peers per crypto map by using different sequence numbers; the router will try them in order.

4.

The 'set peer' command is required for IPsec VPNs; without it, the crypto map is incomplete.

Common Mistakes

Forgetting to enter crypto map config mode before using 'set peer' (e.g., typing it in global config).

Using a private IP address for the peer when the remote device is behind NAT; the peer IP must be the public IP after NAT.

Configuring the peer IP incorrectly (typo) leading to failed VPN establishment.

Not verifying reachability to the peer IP before troubleshooting VPN issues.

set peer [ip] vs show crypto map

These two commands are commonly confused because both relate to crypto map peers in VPN configuration, but one is used for configuration while the other is for verification. 'set peer' defines the remote endpoint in a crypto map, whereas 'show crypto map' displays all configured crypto maps for review.

Aspectset peer [ip]show crypto map
ScopeConfigures a single crypto map entryDisplays all configured crypto map entries
Configuration modeCrypto map configuration modePrivileged EXEC mode
PersistenceWrites to running-configShows current operational state
PrecedenceApplies to specific map entryShows all entries regardless of sequence
Typical useDefining tunnel endpoint addressVerifying peer assignments and transform sets

Use set peer [ip] when configuring a new or existing crypto map entry to specify the remote VPN peer address.

Use show crypto map when verifying or troubleshooting IPsec VPN policy, peer assignments, and transform sets.

Platform Notes

In IOS-XE (e.g., CSR1000v, ISR 4000), the `set peer` command syntax is identical to classic IOS. However, IOS-XE supports additional features like VRF-aware IPsec, where you can specify a VRF for the peer using `set peer [vrf vrf-name] ip-address`. The output of `show crypto map` may include VRF information.

In NX-OS (e.g., Nexus 7000, 9000), the equivalent command is `peer ip` under the crypto map configuration, but NX-OS uses a different configuration hierarchy: first create an IKE policy, then an IPsec policy, then a crypto map. The exact syntax is `crypto map map-name seq-number ipsec-isakmp` then `peer ip address`. NX-OS also supports `set peer` but with slight differences.

On ASA firewalls, the equivalent is `crypto map map-name seq-number set peer ip-address`, but ASA uses a different configuration model (tunnel-group, crypto map applied to interface). In IOS-XR (e.g., ASR 9000), the command is `peer ipv4 address` under the crypto map configuration, but IOS-XR uses a more modular approach with separate IKE and IPsec profiles. The `set peer` command exists in IOS 12.x, 15.x, and 16.x with no syntax changes, but newer versions may support IPv6 peers using `set peer ipv6 address`.

Always check the specific platform documentation for exact syntax.

Related Commands

show crypto map

Displays the configured crypto map entries, including their match criteria, peer addresses, and transform sets, used to verify IPsec VPN policy configuration.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions