Courseiva
VPNCrypto Map Config

set transform-set [name]

Defines an IPsec transform set, which specifies the encryption and authentication algorithms used to protect VPN traffic, and is applied to a crypto map entry.

Definition: set transform-set [name] is a Cisco IOS crypto map config command. Defines an IPsec transform set, which specifies the encryption and authentication algorithms used to protect VPN traffic, and is applied to a crypto map entry.

Overview

The `set transform-set` command is a critical component in Cisco IOS VPN configuration, specifically within crypto map configuration mode. It defines an IPsec transform set, which is a combination of security protocols, encryption algorithms, and authentication algorithms that protect VPN traffic. This command is essential for establishing IPsec VPN tunnels, as it dictates how data is encrypted and authenticated between peers.

Without a properly configured transform set, IPsec negotiations will fail, preventing secure communication. The command is used in conjunction with other crypto map commands like `set peer`, `set pfs`, and `match address` to define the complete VPN policy. It fits into the broader VPN configuration workflow after defining ISAKMP policies and before applying the crypto map to an interface.

The transform set is negotiated during IPsec phase 2, and both peers must have matching transform sets for the tunnel to establish. Important IOS behavior: the transform set is stored in the running configuration and can be modified only when not referenced by any crypto map entry; otherwise, you must remove the crypto map reference first. The command requires global configuration mode access and then crypto map configuration mode (via `crypto map [name] [seq]`).

It does not require any special privilege level beyond what is needed for configuration. The transform set name is locally significant and must be unique per router. Common mistakes include mismatched transform sets between peers, forgetting to specify both encryption and authentication, or using incompatible algorithms (e.g., ESP encryption without ESP authentication).

Understanding this command is vital for CCNA and CCNP candidates as IPsec VPNs are a core topic in both certifications.

Syntax·Crypto Map Config
set transform-set [name]

When to Use This Command

  • Configuring a VPN between two branch offices using AES-256 encryption and SHA-256 authentication.
  • Setting up a remote access VPN for teleworkers with 3DES encryption and MD5 authentication.
  • Creating multiple transform sets for different VPN peers with varying security requirements.
  • Modifying an existing transform set to upgrade from SHA-1 to SHA-256 for stronger integrity.

Parameters

ParameterSyntaxDescription
transform-set-nameWORD (1-64 characters)The name of the transform set. It is a user-defined string that identifies the set. Must be unique on the router. Common practice is to use descriptive names like 'ESP-AES256-SHA' or 'TS-1'. Avoid spaces and special characters. The name is case-sensitive.
encryption-typeesp-aes | esp-aes 192 | esp-aes 256 | esp-des | esp-3des | esp-null | esp-sealSpecifies the encryption algorithm for ESP. Options include AES (128, 192, 256-bit), DES, 3DES, NULL (no encryption), or SEAL. AES is recommended for security. Common mistake: using DES or 3DES which are weak; also forgetting that ESP encryption requires an ESP authentication method.
authentication-typeesp-md5-hmac | esp-sha-hmac | esp-sha256-hmac | esp-sha384-hmac | esp-sha512-hmacSpecifies the authentication algorithm for ESP. Options include MD5, SHA-1, SHA-256, SHA-384, SHA-512. SHA-256 or higher is recommended. Common mistake: using MD5 or SHA-1 which are deprecated; also forgetting that authentication is mandatory when encryption is used.
modetunnel | transportOptional keyword to set the IPsec mode. Default is tunnel. Tunnel mode encrypts the entire IP packet, while transport mode only encrypts the payload. Transport mode is typically used for GRE over IPsec or for protecting traffic between hosts. Common mistake: using transport mode for site-to-site VPNs where tunnel mode is required.

Command Examples

Basic transform set with ESP encryption and authentication

set transform-set ESP-AES256-SHA256
Router(config-crypto-map)# set transform-set ESP-AES256-SHA256
Router(config-crypto-map)#

The command assigns the pre-defined transform set named 'ESP-AES256-SHA256' to the crypto map entry. No output is displayed if successful; the prompt returns to crypto map config mode.

Creating a transform set and applying it to a crypto map

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto map MYMAP 10 ipsec-isakmp set transform-set ESP-3DES-MD5
Router(config)# crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
Router(cfg-crypto-trans)# exit
Router(config)# crypto map MYMAP 10 ipsec-isakmp
Router(config-crypto-map)# set transform-set ESP-3DES-MD5
Router(config-crypto-map)#

First, a transform set named 'ESP-3DES-MD5' is created using 3DES encryption and MD5 HMAC authentication. Then, in crypto map configuration mode for map 'MYMAP' sequence 10, the transform set is applied. No output confirms success.

Understanding the Output

The 'set transform-set' command does not produce any output on its own; it simply associates a transform set with a crypto map entry. To verify the configuration, use 'show crypto map' or 'show crypto ipsec transform-set'. In 'show crypto map', the transform set name appears under each crypto map entry.

For example, 'Transform set={ESP-AES256-SHA256}' indicates the transform set is applied. A missing or incorrect transform set will cause IPsec negotiation failures. Ensure the transform set exists and matches the peer's configuration.

Configuration Scenarios

Site-to-Site VPN with AES-256 and SHA-256

Two branch offices need to securely communicate over the internet. Each branch has a Cisco router with a public IP. The goal is to establish an IPsec VPN tunnel using strong encryption and authentication.

Topology

Branch1(R1-Gi0/0)---203.0.113.1/30---Internet---203.0.113.2/30---(Gi0/0)R2-Branch2

Steps

  1. 1.Step 1: Enter global configuration mode on R1: configure terminal
  2. 2.Step 2: Create an IPsec transform set: crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha256-hmac
  3. 3.Step 3: Create a crypto ACL to define interesting traffic: access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
  4. 4.Step 4: Create a crypto map: crypto map CMAP 10 ipsec-isakmp
  5. 5.Step 5: Set the peer: set peer 203.0.113.2
  6. 6.Step 6: Set the transform set: set transform-set AES256-SHA
  7. 7.Step 7: Match the ACL: match address 100
  8. 8.Step 8: Apply the crypto map to the outside interface: interface GigabitEthernet0/0, crypto map CMAP
  9. 9.Step 9: Repeat similar configuration on R2 with reversed ACL and peer.
Configuration
! R1 Configuration
crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha256-hmac
!
access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
!
crypto map CMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set AES256-SHA
 match address 100
!
interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.252
 crypto map CMAP

Verify: Use 'show crypto ipsec sa' to verify the tunnel is up. Look for 'encaps' and 'decaps' counters incrementing. Also 'show crypto isakmp sa' to verify IKE phase 1 is established.

Watch out: Both peers must have the exact same transform set name and parameters. A common mistake is using different encryption or authentication algorithms, causing negotiation failure.

Remote Access VPN with Transport Mode

A mobile employee needs to connect to the corporate network using a VPN client. The router acts as a VPN headend. Transport mode is used because the client software encapsulates the original IP packet.

Topology

Client---Internet---R1(Gi0/0)---Inside(LAN)

Steps

  1. 1.Step 1: On R1, create a transform set for remote access: crypto ipsec transform-set RA-TS esp-aes 256 esp-sha256-hmac
  2. 2.Step 2: Set mode to transport: mode transport
  3. 3.Step 3: Create dynamic crypto map for clients: crypto dynamic-map DYNMAP 10
  4. 4.Step 4: Set transform set: set transform-set RA-TS
  5. 5.Step 5: Create a crypto map that references the dynamic map: crypto map CMAP 10 ipsec-isakmp dynamic DYNMAP
  6. 6.Step 6: Apply to outside interface: interface GigabitEthernet0/0, crypto map CMAP
  7. 7.Step 7: Configure ISAKMP policy and group policy for client authentication.
Configuration
! R1 Configuration
crypto ipsec transform-set RA-TS esp-aes 256 esp-sha256-hmac
 mode transport
!
crypto dynamic-map DYNMAP 10
 set transform-set RA-TS
!
crypto map CMAP 10 ipsec-isakmp dynamic DYNMAP
!
interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.0
 crypto map CMAP

Verify: Use 'show crypto ipsec sa' to see active SAs. For remote access, the peer address will be the client's public IP. Also 'show crypto isakmp sa' to see IKE SAs.

Watch out: Transport mode is often mistakenly used for site-to-site VPNs. Ensure the client supports transport mode. Also, dynamic crypto maps require ISAKMP policies and AAA for client authentication.

Troubleshooting with This Command

When troubleshooting IPsec VPN issues, the `set transform-set` command itself is not directly used for diagnostics, but its configuration is verified through show commands. The primary command to verify transform set configuration is `show crypto ipsec transform-set`. This displays all configured transform sets, their parameters, and whether they are currently in use.

A healthy output shows the transform set with the expected encryption and authentication algorithms, and the 'in use' status if referenced by a crypto map. Problem indicators include: missing transform set (not configured), incorrect algorithm (e.g., DES instead of AES), or the transform set not being referenced by any crypto map. Common symptoms that this command helps diagnose include: IPsec SA negotiation failures (phase 2 failure), where the debug output 'show crypto ipsec sa' shows 'no matching transform set' or 'transform set mismatch'.

In such cases, verify that both peers have identical transform sets. Another symptom is that the tunnel does not come up even though IKE phase 1 is successful; this often points to a transform set mismatch. The step-by-step diagnostic flow: 1) Check ISAKMP SA with 'show crypto isakmp sa' – ensure state is MM_ACTIVE. 2) Check IPsec SA with 'show crypto ipsec sa' – look for 'encaps' and 'decaps' counters; if zero, the tunnel is not passing traffic. 3) Use 'show crypto ipsec transform-set' to confirm the transform set parameters. 4) Use 'show crypto map' to verify the crypto map references the correct transform set. 5) Use debug commands like 'debug crypto ipsec' and 'debug crypto isakmp' to see negotiation details.

Focus on the transform set proposal during phase 2: the initiator sends a proposal with its transform set, and the responder checks if it has a matching set. If not, the negotiation fails. Correlate the output of 'show crypto ipsec transform-set' with the peer's configuration.

Also, ensure that the transform set is not using deprecated algorithms like DES or MD5, as modern peers may reject them. Another common issue is forgetting to specify the mode; if one side uses tunnel and the other transport, negotiation fails. Use 'show crypto ipsec transform-set [name]' to see the mode.

In summary, the transform set is a fundamental building block; misconfiguration here leads to tunnel failure, and systematic verification using show commands is essential.

CCNA Exam Tips

1.

CCNA exam tip 1: Transform sets must match on both VPN peers; mismatched algorithms cause IKE phase 2 failure.

2.

CCNA exam tip 2: The 'set transform-set' command is used in crypto map config mode, not global config.

3.

CCNA exam tip 3: Know that ESP provides both encryption and authentication; AH is rarely used and not in CCNA scope.

4.

CCNA exam tip 4: Transform sets are created globally and then referenced by name in the crypto map.

Common Mistakes

Mistake 1: Forgetting to create the transform set before referencing it in the crypto map, resulting in an error.

Mistake 2: Using incompatible algorithms (e.g., esp-aes and esp-sha-hmac) that are not supported together.

Mistake 3: Applying the transform set in global config mode instead of crypto map config mode.

set transform-set [name] vs crypto ipsec transform-set [name] esp-aes esp-sha-hmac

These two commands are commonly confused because both involve IPsec transform sets, but one defines a transform set globally while the other applies an existing transform set to a crypto map entry. Understanding their distinct roles is crucial for correct IPsec VPN configuration.

Aspectset transform-set [name]crypto ipsec transform-set [name] esp-aes esp-sha-hmac
ScopeApplies a transform set to a specific crypto map entryDefines a transform set globally
Configuration modeCrypto map configuration modeGlobal configuration mode
PersistenceOnly persists while crypto map is appliedPersists in running-config and startup-config as a named transform set
PrecedenceCannot be used without a defined transform setMust be issued before using set transform-set
Typical useAssociates an existing transform set with a crypto map entryCreates a transform set with specific encryption and authentication algorithms

Use set transform-set [name] when you want to apply a previously defined transform set to a specific crypto map entry within crypto map configuration mode.

Use crypto ipsec transform-set [name] esp-aes esp-sha-hmac when you need to define a new transform set globally with desired encryption and authentication algorithms.

Platform Notes

In IOS-XE (e.g., CSR1000v, ISR 4000 series), the `set transform-set` command syntax is identical to classic IOS. However, IOS-XE supports additional encryption algorithms like AES-GCM (esp-gcm) and AES-CCM (esp-ccm) for newer hardware. The output of `show crypto ipsec transform-set` may include additional fields like 'compression' or 'anti-replay'.

In NX-OS (e.g., Nexus 7000, 9000), the equivalent command is `crypto ipsec transform-set [name] [encryption] [authentication]` within the `crypto ipsec` configuration mode. The syntax is similar but NX-OS uses different mode keywords: `mode tunnel` or `mode transport` is set separately. Also, NX-OS requires the `no shutdown` command under the transform set to activate it.

For ASA firewalls, the equivalent is `crypto ipsec transform-set [name] [encryption] [authentication]` in global configuration mode, but the ASA uses a different command hierarchy: transform sets are defined globally and then referenced in crypto maps. The ASA also supports additional options like `esp-aes-256` and `esp-sha-256`. In IOS-XR (e.g., ASR 9000), the command is `crypto ipsec transform-set [name]` with similar parameters, but the configuration is done under the `crypto` sub-mode.

IOS-XR also supports `esp-aes-gcm` and `esp-aes-ccm`. Between IOS versions, there are minor differences: IOS 12.x supports only DES, 3DES, AES-128, AES-192, AES-256, and SHA-1/MD5. IOS 15.x adds SHA-256/384/512 and SEAL.

IOS 16.x (like IOS-XE 16.x) adds GCM and CCM. Always check the specific platform documentation for supported algorithms. The command is available in all IOS-based platforms, but the exact algorithm support varies.

Related Commands

crypto ipsec transform-set [name] esp-aes esp-sha-hmac

Defines an IPsec transform set specifying the encryption and authentication algorithms to protect VPN traffic, used when configuring an IPsec VPN policy.

show crypto map

Displays the configured crypto map entries, including their match criteria, peer addresses, and transform sets, used to verify IPsec VPN policy configuration.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions