A crypto map<\/b>\u2014is a Cisco IOS software configuration entity that performs two primary functions. First, it selects data flows that need security processing. Second, it defines the policy for these flows and the crypto peer that traffic needs to go to. A crypto map is applied to an interface. The concept of a crypto map was introduced in classic crypto but was expanded for IPsec.\u00a0 This aide-memoir pulls together items from Cisco.com to provide a useful recipe and refresher.<\/p>\n
STEP 1 (configure Interfaces):<\/strong> STEP 2 (configure ISAKMP)<\/strong> – The negotiation protocol that allows hosts to agree IPSec security associations): IKE PHASE ONE:<\/strong> IKE phase one occurs in two modes:<\/p>\n Phase\u00a01 can take place in either Main or Aggressive mode.<\/p>\n Main mode<\/span><\/strong>\u2014The initiator and recipient send three two-way exchanges (six messages total) to accomplish the following services:<\/p>\n The information transmitted in the third exchange of messages is protected by the encryption algorithm established in the first two exchanges. Thus, the participants’ identities are not transmitted in the clear.<\/p>\n Aggressive Mode<\/span><\/strong>\u2014The initiator and recipient accomplish the same objectives, but in only two exchanges, with a total of three messages:<\/p>\n Because the participants’ identities are exchanged in the clear (in the first two messages), Aggressive mode does not provide identity protection.<\/p>\n MAIN MODE AND AGGRESSIVE MODE:<\/strong><\/span><\/p>\n Main Mode<\/strong> Aggressive Mode<\/strong>: IKE PHASE TWO<\/strong>: IKE phase 2 has one mode, called quick mode. Quick mode occurs after IKE has established the secure tunnel in phase one. It negotiates a shared IPSec policy, derives shared secret keying material used for the IPSec security algorithms, and establishes IPSec SAs. Quick mode exchanges nonces that provide replay protection. The nonces are used to generate new shared secret key material and prevent replay attacks from generating bogus SAs.<\/p>\n Quick mode is also used to renegotiate a new IPSec SA when the IPSec SA lifetime expires. Base quick mode is used to refresh the keying material used to create the shared secret key based on the keying material derived from the Diffie-Hellman exchange in phase one. If perfect forward secrecy (PFS) is specified in the IPSec policy, a new Diffie-Hellman exchange is performed with each quick mode, providing keying material that has greater entropy (key material life) and thereby greater resistance to cryptographic attacks. Each Diffie-Hellman exchange requires large exponentiations, thereby increasing CPU use and exacting a performance cost.<\/p>\n Configuring Cisco ASA ISAKMP Policies:<\/strong><\/span><\/p>\n To configure ISAKMP policies, in global configuration mode use the isakmp policy command with its various arguments. The syntax for ISAKMP policy commands is as follows: isakmp policy priority attribute_name [attribute_value | integer].<\/p>\n Set the policy to define: STEP 3 (Create Transform Set):<\/strong> A transform set protects the data flows for the access list specified in the associated crypto map entry. You can create transform sets in the ASA configuration, and then specify a maximum of 11 of them in a crypto map or dynamic crypto map entry.<\/p>\n Tunnel Mode is the usual way to implement IPsec between two ASAs that are connected over an untrusted network, such as the public Internet. Tunnel mode is the default and requires no configuration.<\/p>\n
\nhostname(config)#interface ethernet0
\nhostname(config-if)#ip address 10.10.4.100 255.255.0.0
\nhostname(config-if)#no shutdown<\/p>\n
\nEach ISAKMP negotiation is divided into two sections called Phase1 and Phase 2.
\n– Phase 1 creates the first tunnel, which protects later ISAKMP negotiation messages<\/strong>.
\n– Phase 2 creates the tunnel that protects data travelling across the secure connection<\/strong>.<\/p>\n
\nThe basic purpose of IKE phase one is to authenticate the IPSec peers and to set up a secure channel between the peers to enable IKE exchanges. IKE phase one performs the following functions:<\/p>\n\n
\n
\n
\n
![\"IKE-MM-and-AM\"](\"http:\/\/darenmatthews.com\/blog\/wp-content\/uploads\/2014\/01\/IKE-MM-and-AM.gif\")
<\/a><\/p>\n
\nIKE MM has three two-way exchanges between the initiator and receiver:<\/p>\n\n
<\/a><\/li>\n<\/a><\/li>\n<\/ul>\n
\nIn the aggressive mode, fewer exchanges are done and with fewer packets. In the first exchange, almost everything is squeezed into the proposed IKE SA values, the Diffie-Hellman public key, a nonce that the other party signs, and an identity packet, which can be used to verify the initiator’s identity through a third party. The receiver sends everything back that is needed to complete the exchange. The only thing left is for the initiator to confirm the exchange. The weakness of using the aggressive mode is that both sides have exchanged information before there is a secure channel. Therefore, it is possible to sniff the wire and discover who formed the new SA. However, aggressive mode is faster than main mode.<\/p>\n
\nThe purpose of IKE phase two is to negotiate IPSec SAs to set up the IPSec tunnel. IKE phase two performs the following functions:<\/p>\n\n
<\/a><\/a><\/a><\/p>\n
\nPerfect Forward Secrecy<\/p>\n
\nhostname(config)#isakmp policy 1 authentication pre-share\u00a0 <=== authentication method (to ensure identity of peers)
\nhostname(config)#isakmp policy 1 encryption 3des\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <=== encryption method (to ensure privacy)
\nhostname(config)#isakmp policy 1 hash sha\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <=== Hashed Message Authentication Codes method to ensure identity of peer and message integrity
\nhostname(config)#isakmp policy 1 group 2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <=== A Diffie-Hellman group (establish the strength of the encryption-key-determination algorithm)
\nhostname(config)#isakmp policy 1 lifetime 43200\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <=== A time limit for how long the ASA uses an encryption key before replacing it
\nhostname(config)#isakmp enable outside<\/p>\n<\/a><\/p>\n
\nA transform set combines an encryption method and an authentication method. During the IPsec security association negotiation with ISAKMP, the peers agree to use a particular transform set to protect a particular data flow. The transform set must be the same for both peers.<\/p>\n<\/a><\/p>\n<\/a><\/a><\/p>\n