Cisco Encryption Technology Commands

This chapter describes the function and displays the syntax for Cisco Encryption Technology (CET) commands. For more information about defaults and usage guidelines, see the corresponding chapter of the Security Command Reference.

access-list (encryption)

To define an encryption access list by number, use the extended IP access-list global configuration command. Use the no form of this command to remove a numbered encryption access list.

access-list-number	Number of an encryption access list. This is a decimal number from 100 to 199.
dynamic dynamic-name	(Optional) Identifies this encryption access list as a dynamic encryption access list.
timeout minutes	(Optional) Specifies the absolute length of time (in minutes) that a temporary access list entry can remain in a dynamic access list. The default is an infinite length of time and allows an entry to remain permanently.
deny	Does not encrypt/decrypt IP traffic if the conditions are matched.
permit	Encrypts/decrypts IP traffic if the conditions are matched.
protocol	Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol, including ICMP, TCP, and UDP, use the keyword ip. Some protocols allow further qualifiers, as described in text that follows.
source	Number of the network or host from which the packet is being sent. There are three other ways to specify the source: Use a 32-bit quantity in four-part dotted-decimal format. Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended (see the section "Usage Guidelines"). Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.
source-wildcard	Wildcard bits (mask) to be applied to source. There are three other ways to specify the source wildcard: Use a 32-bit quantity in four-part dotted-decimal format. Place ones in the bit positions you want to ignore. Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.
destination	Number of the network or host to which the packet is being sent. There are three other ways to specify the destination: Use a 32-bit quantity in four-part dotted-decimal format. Use the keyword any as an abbreviation for the destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.
destination-wildcard	Wildcard bits to be applied to the destination. There are three other ways to specify the destination wildcard: Use a 32-bit quantity in four-part dotted-decimal format. Place ones in the bit positions you want to ignore. Use the keyword any as an abbreviation for a destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.
precedence precedence	(Optional) Packets can be matched for encryption by precedence level, as specified by a number from 0 to 7 or by name.
tos tos	(Optional) Packets can be matched for encryption by type of service level, as specified by a number from 0 to 15 or by name as listed in the section "Usage Guidelines."
port	(Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535. TCP port names can be used only when filtering TCP. UDP port names can be used only when filtering UDP.
icmp-type	(Optional) ICMP packets can be matched for encryption by ICMP message type. The type is a number from 0 to 255.
icmp-code	(Optional) ICMP packets that are matched for encryption by ICMP message type can also be matched by the ICMP message code. The code is a number from 0 to 255.
icmp-message	(Optional) ICMP packets can be matched for encryption by an ICMP message type name or ICMP message type and code name.
igmp-type	(Optional) IGMP packets can be matched for encryption by IGMP message type or message name. A message type is a number from 0 to 15.
operator	(Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range). If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number.
established	(Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection.
log	(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.) The message includes the access list number, whether the packet was encrypted/decrypted or not; the protocol, whether it was TCP, UDP, ICMP, or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets encrypted/decrypted or not in the prior 5-minute interval.

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}
protocol source source-wildcard destination destination-wildcard [precedence precedence]
[tos tos] [log]
no access-list access-list-number
access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}
icmp source source-wildcard destination destination-wildcard [icmp-type [icmp-code] |
icmp-message] [precedence precedence] [tos tos] [log]
access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}
igmp source source-wildcard destination destination-wildcard [igmp-type]
[precedence precedence] [tos tos] [log]
access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}
tcp source source-wildcard [operator port [port]] destination destination-wildcard
[operator port [port]] [established] [precedence precedence] [tos tos] [log]
access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit}
udp source source-wildcard [operator port [port]] destination destination-wildcard
[operator port [port]] [precedence precedence] [tos tos] [log]

access-list-number

Number of an encryption access list. This is a decimal number from 100 to 199.

dynamic dynamic-name

(Optional) Identifies this encryption access list as a dynamic encryption access list.

timeout minutes

(Optional) Specifies the absolute length of time (in minutes) that a temporary access list entry can remain in a dynamic access list. The default is an infinite length of time and allows an entry to remain permanently.

deny

Does not encrypt/decrypt IP traffic if the conditions are matched.

permit

Encrypts/decrypts IP traffic if the conditions are matched.

protocol

Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol, including ICMP, TCP, and UDP, use the keyword ip. Some protocols allow further qualifiers, as described in text that follows.

source

Number of the network or host from which the packet is being sent. There are three other ways to specify the source:

Use a 32-bit quantity in four-part dotted-decimal format.

Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended (see the section "Usage Guidelines").

Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

source-wildcard

Wildcard bits (mask) to be applied to source. There are three other ways to specify the source wildcard:

Use a 32-bit quantity in four-part dotted-decimal format. Place ones in the bit positions you want to ignore.

Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

destination

Number of the network or host to which the packet is being sent. There are three other ways to specify the destination:

Use a 32-bit quantity in four-part dotted-decimal format.

Use the keyword any as an abbreviation for the destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended.

Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

destination-wildcard

Wildcard bits to be applied to the destination. There are three other ways to specify the destination wildcard:

Use a 32-bit quantity in four-part dotted-decimal format. Place ones in the bit positions you want to ignore.

Use the keyword any as an abbreviation for a destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended.

Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

precedence precedence

(Optional) Packets can be matched for encryption by precedence level, as specified by a number from 0 to 7 or by name.

tos tos

(Optional) Packets can be matched for encryption by type of service level, as specified by a number from 0 to 15 or by name as listed in the section "Usage Guidelines."

port

(Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535.

TCP port names can be used only when filtering TCP.

UDP port names can be used only when filtering UDP.

icmp-type

(Optional) ICMP packets can be matched for encryption by ICMP message type. The type is a number from 0 to 255.

icmp-code

(Optional) ICMP packets that are matched for encryption by ICMP message type can also be matched by the ICMP message code. The code is a number from 0 to 255.

icmp-message

(Optional) ICMP packets can be matched for encryption by an ICMP message type name or ICMP message type and code name.

igmp-type

(Optional) IGMP packets can be matched for encryption by IGMP message type or message name. A message type is a number from 0 to 15.

operator

(Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).

If the operator is positioned after the source and source-wildcard, it must match the source port.

If the operator is positioned after the destination and destination-wildcard, it must match the destination port.

The range operator requires two port numbers. All other operators require one port number.

established

(Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection.

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

The message includes the access list number, whether the packet was encrypted/decrypted or not; the protocol, whether it was TCP, UDP, ICMP, or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets encrypted/decrypted or not in the prior 5-minute interval.

clear crypto connection

To terminate an encrypted session in progress, use the clear crypto connection global configuration command.

connection-id	Identifies the encrypted session to terminate.
slot	(Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers. If no slot is specified, the Cisco IOS crypto engine will be selected. Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500).
rsm	(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Route Switch Module on the Cisco Catalyst 5000 series switch.
vip	(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

clear crypto connection connection-id [slot | rsm | vip]

connection-id

Identifies the encrypted session to terminate.

slot

(Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.

If no slot is specified, the Cisco IOS crypto engine will be selected.

Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500).

rsm

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Route Switch Module on the Cisco Catalyst 5000 series switch.

vip

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

crypto algorithm 40-bit-des

The crypto cisco algorithm 40-bit-des command replaces this command. Refer to the description of the crypto cisco algorithm 40-bit-des command in this chapter for further details.

crypto algorithm des

The crypto cisco algorithm des command replaces this command. Refer to the description of the crypto cisco algorithm des command in this chapter for further details.

crypto card

To enable (select) either the ESA crypto engine or the Cisco IOS crypto engine in Cisco 7200 series routers, use the crypto card global configuration command.

enable	Selects the ESA crypto engine by enabling the ESA.
shutdown	Selects the Cisco IOS crypto engine by shutting down the ESA.
slot	The ESA chassis slot number.

crypto card {enable | shutdown} slot

enable

Selects the ESA crypto engine by enabling the ESA.

shutdown

Selects the Cisco IOS crypto engine by shutting down the ESA.

slot

The ESA chassis slot number.

crypto card clear-latch

To reset an Encryption Service Adapter (ESA), use the crypto card clear-latch global configuration command. This command resets the ESA by clearing a hardware extraction latch that is set when an ESA is removed and reinstalled in the chassis.

slot	Identifies the ESA to reset. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers. On a Cisco 7200 series router, this is the ESA chassis slot number. On a Cisco RSP7000 or 7500 series router, this is the chassis slot number of the ESA's second-generation Versatile Interface Processor (VIP2).
vip	This keyword is only available on the Cisco Catalyst 5000 series switch. Identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

crypto card clear-latch {slot | vip}

slot

Identifies the ESA to reset. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.

On a Cisco 7200 series router, this is the ESA chassis slot number. On a Cisco RSP7000 or 7500 series router, this is the chassis slot number of the ESA's second-generation Versatile Interface Processor (VIP2).

vip

This keyword is only available on the Cisco Catalyst 5000 series switch. Identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

crypto cisco algorithm 40-bit-des

To globally enable 40-bit Data Encryption Standard (DES) algorithm types, use the crypto cisco algorithm 40-bit-des global configuration command. Use the no form of this command to globally disable a 40-bit DES algorithm type.

cfb-8	(Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the 40-bit DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default.
cfb-64	(Optional) Selects the 64-bit CFB mode of the 40-bit DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default.

crypto cisco algorithm 40-bit-des [cfb-8 | cfb-64]
no crypto cisco algorithm 40-bit-des [cfb-8 | cfb-64]

cfb-8

(Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the 40-bit DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default.

cfb-64

(Optional) Selects the 64-bit CFB mode of the 40-bit DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default.

crypto cisco algorithm des

To globally enable Data Encryption Standard (DES) algorithm types that use a 56-bit DES key, use the crypto cisco algorithm des global configuration command. Use the no form of this command to globally disable a DES algorithm type.

cfb-8	(Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the basic DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default.
cfb-64	(Optional) Selects the 64-bit CFB mode of the basic DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default.

crypto cisco algorithm des [cfb-8 | cfb-64]
no crypto cisco algorithm des [cfb-8 | cfb-64]

cfb-8

(Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the basic DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default.

cfb-64

(Optional) Selects the 64-bit CFB mode of the basic DES algorithm. If no CFB mode is specified when you issue the command, 64-bit CFB mode is the default.

crypto cisco connections

To change the maximum number of destinations (hosts or subnets) per source that you can define in encryption access list statements, use the crypto cisco connections global configuration command. Use the no form of the command to restore the default.

number	Specifies the maximum number of destinations per source. Use a value from 3 to 500. This argument is not required when using the no form of the command.

crypto cisco connections number
no crypto cisco connections [number]

number

Specifies the maximum number of destinations per source. Use a value from
3 to 500.

This argument is not required when using the no form of the command.

crypto cisco entities

To change the maximum number of sources (hosts or subnets) that you can define in encryption access list statements, use the crypto cisco entities global configuration command. Use the no form of the command to restore the default.

number	Specifies the maximum number of sources. Use a value from 3 to 500. This argument is not required when using the no form of the command.

crypto cisco entities number
no crypto cisco entities [number]

number

Specifies the maximum number of sources. Use a value from 3 to 500.

This argument is not required when using the no form of the command.

crypto cisco key-timeout

To specify the duration of encrypted sessions, use the crypto cisco key-timeout global configuration command. Use the no form to restore the duration of encrypted sessions to the default of 30 minutes.

minutes	Specifies the duration of encrypted sessions. Can be from 1 to 1440 minutes (24 hours) in 1 minute increments. Specified by an integer from 1 to 1440. When the no form of the command is used, this argument is optional. Any value supplied for the argument is ignored by the router.

crypto cisco key-timeout minutes
no crypto cisco key-timeout minutes

minutes

Specifies the duration of encrypted sessions. Can be from 1 to 1440 minutes (24 hours) in 1 minute increments. Specified by an integer from 1 to 1440.

When the no form of the command is used, this argument is optional. Any value supplied for the argument is ignored by the router.

crypto cisco pregen-dh-pairs

To enable pregeneration of Diffie-Hellman (DH) public numbers, use the crypto cisco pregen-dh-pairs global configuration command. Use the no form to disable pregeneration of DH public numbers for all crypto engines.

count	Specifies how many DH public numbers to pregenerate and hold in reserve. Specified by an integer from 0 to 10.
slot	(Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers. If no slot is specified, the Cisco IOS crypto engine will be selected. Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500).
rsm	(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. Identifies the Route Switch Module on the Cisco Catalyst 5000 series switch.
vip	(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. Identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

crypto cisco pregen-dh-pairs count [slot | rsm | vip]
no crypto cisco pregen-dh-pairs

count

Specifies how many DH public numbers to pregenerate and hold in reserve. Specified by an integer from 0 to 10.

slot

(Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.

If no slot is specified, the Cisco IOS crypto engine will be selected.

Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500).

rsm

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. Identifies the Route Switch Module on the Cisco Catalyst 5000 series switch.

vip

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. Identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

crypto clear-latch

The crypto card clear-latch command replaces this command. Refer to the description of the crypto card clear-latch command in this chapter for further details.

crypto esa

The crypto card command replaces this command. Refer to the description of the crypto card command in this chapter for further details.

crypto gen-signature-keys

The crypto key generate dss command replaces this command. Refer to the description of the crypto key generate dss command in this chapter for further details.

crypto key-exchange

The crypto key exchange dss command replaces this command. Refer to the description of the crypto key exchange dss command in this chapter for further details.

crypto key exchange dss

To exchange Digital Signature Standard (DSS) public keys, the administrator of the peer encrypting router that is designated ACTIVE must use the crypto key exchange dss global configuration command.

ip-address	The IP address of the peer router (designated PASSIVE) participating with you in the key exchange.
key-name	Identifies the crypto engine---either the Cisco IOS crypto engine, a second-generation Versatile Interface Processor (VIP2) crypto engine, or an Encryption Service Adapter (ESA) crypto engine. This name must match the key-name argument assigned when you generated DSS keys using the crypto key generate dss command.
tcp-port	(Optional) Cisco IOS software uses the unassigned¹ TCP port number of 1964 to designate a key exchange. You may use this optional keyword to select a different number to designate a key exchange, if your system already uses the port number 1964 for a different purpose. If this keyword is used, you must use the same value as the PASSIVE router's tcp-port value.

crypto key exchange dss ip-address key-name [tcp-port]

ip-address

The IP address of the peer router (designated PASSIVE) participating with you in the key exchange.

key-name

Identifies the crypto engine---either the Cisco IOS crypto engine, a second-generation Versatile Interface Processor (VIP2) crypto engine, or an Encryption Service Adapter (ESA) crypto engine. This name must match the key-name argument assigned when you generated DSS keys using the crypto key generate dss command.

tcp-port

(Optional) Cisco IOS software uses the unassigned¹ TCP port number of 1964 to designate a key exchange. You may use this optional keyword to select a different number to designate a key exchange, if your system already uses the port number 1964 for a different purpose. If this keyword is used, you must use the same value as the PASSIVE router's tcp-port value.

¹1964 is a TCP port number that has not been preassigned by the Internetworking Engineering Task Force (IETF).

crypto key exchange dss passive

To enable an exchange of Digital Signature Standard (DSS) public keys, the administrator of the peer encrypting router that is designated PASSIVE must use the crypto key exchange dss passive global configuration command.

tcp-port	(Optional) Cisco IOS software uses the unassigned¹ TCP port number of 1964 to designate a key exchange. You may use this optional keyword to select a different number to designate a key exchange, if your system already uses the port number 1964 for a different purpose. If this keyword is used, you must use the same value as the ACTIVE router's tcp-port value.

crypto key exchange dss passive [tcp-port]

tcp-port

(Optional) Cisco IOS software uses the unassigned¹ TCP port number of 1964 to designate a key exchange. You may use this optional keyword to select a different number to designate a key exchange, if your system already uses the port number 1964 for a different purpose. If this keyword is used, you must use the same value as the ACTIVE router's tcp-port value.

¹1964 is a TCP port number that has not been preassigned by the Internetworking Engineering Task Force (IETF).

crypto key-exchange passive

The crypto key exchange dss passive command replaces this command. Refer to the description of the crypto key exchange dss passive command inthis chapter for further details.

crypto key generate dss

To generate a Digital Signature Standard (DSS) public/private key pair, use the crypto key generate dss global configuration command.

key-name	A name you assign to the crypto engine. This will name either the Cisco IOS software crypto engine, a second-generation Versatile Interface Processor (VIP2) crypto engine, or an Encryption Service Adapter (ESA) crypto engine. Any character string is valid. Using a fully qualified domain name might make it easier to identify public keys.
slot	(Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers. If no slot is specified, the Cisco IOS crypto engine will be selected. Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500).
rsm	(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. Identifies the Route Switch Module on the Cisco Catalyst 5000 series switch.
vip	(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. Identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

crypto key generate dss key-name [slot | rsm | vip]

key-name

A name you assign to the crypto engine. This will name either the Cisco IOS software crypto engine, a second-generation Versatile Interface Processor (VIP2) crypto engine, or an Encryption Service Adapter (ESA) crypto engine. Any character string is valid. Using a fully qualified domain name might make it easier to identify public keys.

slot

(Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.

If no slot is specified, the Cisco IOS crypto engine will be selected.

Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500).

rsm

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. Identifies the Route Switch Module on the Cisco Catalyst 5000 series switch.

vip

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. Identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

crypto key pubkey-chain dss

To manually specify the Digital Signature Standard (DSS) public key of a peer encrypting router, use the crypto key pubkey-chain dss global configuration command. Use the no form of this command to delete the DSS public key of a peer encrypting router.

key-name	Identifies the crypto engine of the peer encrypting router. If the device is a Cisco router, the name should be a fully qualified domain name.
special-usage	(Optional) If the special-usage parameter is not specified, the key is considered a general-purpose key.
serial-number	The serial number of the peer encrypting router's public DSS key. When the no form of the command is used, this argument is optional. Any value supplied for the argument is ignored by the router.
hex	(Optional) The DSS public key of the peer encrypting router, in hexadecimal format.
quit	When you are done entering the public key, type quit to exit the hex input mode.

crypto key pubkey-chain dss named-key key-name [special-usage]
serial-number [special-usage] key-string [ hex1 hex2 hex3 ... ] quit
no crypto key pubkey-chain dss key-name [serial-number]

key-name

Identifies the crypto engine of the peer encrypting router. If the device is a Cisco router, the name should be a fully qualified domain name.

special-usage

(Optional) If the special-usage parameter is not specified, the key is considered a general-purpose key.

serial-number

The serial number of the peer encrypting router's public DSS key.

When the no form of the command is used, this argument is optional. Any value supplied for the argument is ignored by the router.

hex

(Optional) The DSS public key of the peer encrypting router, in hexadecimal format.

quit

When you are done entering the public key, type quit to exit the hex input mode.

crypto key-timeout

The crypto cisco key-timeout command replaces this command. Refer to the description of the crypto cisco key-timeout command in this chapter for further details.

crypto key zeroize dss

To delete the Digital Signature Standard (DSS) public/private key pair of a crypto engine, use the crypto key zeroize dss global configuration command.

slot	(Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers. If no slot is specified, the Cisco IOS crypto engine will be selected. Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500).
rsm	(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Route Switch Module on the Cisco Catalyst 5000 series switch.
vip	(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

crypto key zeroize dss [slot | rsm | vip]

slot

(Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.

If no slot is specified, the Cisco IOS crypto engine will be selected.

Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500).

rsm

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Route Switch Module on the Cisco Catalyst 5000 series switch.

vip

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

crypto map (global configuration)

To create or modify a crypto map entry and enter the crypto map configuration mode, use the crypto map global configuration command. Use the no form of this command to delete a crypto map entry or set.

cisco	(Default value) Indicates that CET will be used instead of IPSec for protecting the traffic specified by this newly specified crypto map entry. If you use this keyword, none of the IPSec-specific crypto map configuration commands will be available. Instead, the CET-specific commands will be available.
map-name	The name you assign to the crypto map set.
seq-num	The number you assign to the crypto map entry.

crypto map map-name seq-num [cisco]
no crypto map map-name [seq-num]

cisco

(Default value) Indicates that CET will be used instead of IPSec for protecting the traffic specified by this newly specified crypto map entry. If you use this keyword, none of the IPSec-specific crypto map configuration commands will be available. Instead, the CET-specific commands will be available.

map-name

The name you assign to the crypto map set.

seq-num

The number you assign to the crypto map entry.

crypto map (interface configuration)

To apply a previously defined crypto map to an interface, use the crypto map interface configuration command. Use the no form of the command to eliminate the crypto map from the interface.

map-name	The name which identifies the crypto map. This is the name assigned when the crypto map was created. When the no form of the command is used, this argument is optional. Any value supplied for the argument is ignored.

crypto map map-name
no crypto map [map-name]

map-name

The name which identifies the crypto map. This is the name assigned when the crypto map was created.

When the no form of the command is used, this argument is optional. Any value supplied for the argument is ignored.

crypto pregen-dh-pairs

The crypto cisco pregen-dh-pairs command replaces this command. Refer to the description of the crypto cisco pregen-dh-pairs command in this chapter for further details.

crypto public-key

The crypto key pubkey-chain dss command replaces this command. Refer to the description of the crypto key pubkey-chain dss command for more information.

crypto sdu connections

The crypto cisco connections command replaces this command. Refer to the description of the crypto cisco connections command in this chapter for further details.

crypto sdu entities

The crypto cisco entities command replaces this command. Refer to the description of the crypto cisco entities command in this chapter for further details.

crypto zeroize

The crypto key zeroize dss command replaces this command. Refer to the description of the crypto key zeroize dss command in this chapter for further details.

deny

To set conditions for a named encryption access list, use the deny access-list configuration command. The deny command prevents IP traffic from being encrypted/decrypted if the conditions are matched. Use the no form of this command to remove a deny condition from an encryption access list.

source	Number of the network or host from which the packet is being sent. There are three alternative ways to specify the source: Use a 32-bit quantity in four-part, dotted-decimal format. Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.
source-wildcard	(Optional) Wildcard bits to be applied to the source. There are three alternative ways to specify the source wildcard: Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore. Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.
protocol	Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 through 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip. Some protocols allow further qualifiers described later.
destination	Number of the network or host to which the packet is being sent. There are three alternative ways to specify the destination: Use a 32-bit quantity in four-part, dotted-decimal format. Use the keyword any as an abbreviation for the destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended (see the section "Usage Guidelines"). Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.
destination-wildcard	Wildcard bits to be applied to the destination. There are three alternative ways to specify the destination wildcard: Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore. Use the keyword any as an abbreviation for a destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.
precedence precedence	(Optional) Packets can be matched for encryption by precedence level, as specified by a number from 0 to 7 or by name.
tos tos	(Optional) Packets can be matched for encryption by type of service level, as specified by a number from 0 to 15 or by name.
log	(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.) The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.
icmp-type	(Optional) ICMP packets can be matched for encryption by ICMP message type. The type is a number from 0 to 255.
icmp-code	(Optional) ICMP packets which are matched for encryption by ICMP message type can also be matched by the ICMP message code. The code is a number from 0 to 255.
icmp-message	(Optional) ICMP packets can be matched for encryption by an ICMP message type name or ICMP message type and code name.
igmp-type	(Optional) IGMP packets can be matched for encryption by IGMP message type or message name. A message type is a number from 0 to 15.
operator	(Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range). If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number.
port	(Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65,535. TCP and UDP port names are listed in the "Usage Guidelines" section of the access-list (encryption) command. TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP.
established	(Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection.

deny source [source-wildcard]
no deny source [source-wildcard]
deny protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log]
no deny protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log]
deny icmp source source-wildcard destination destination-wildcard [icmp-type [icmp-code] |
icmp-message] [precedence precedence] [tos tos] [log]
deny igmp source source-wildcard destination destination-wildcard [igmp-type]
[precedence precedence] [tos tos] [log]
deny tcp source source-wildcard [operator port [port]] destination destination-wildcard
[operator port [port]] [established] [precedence precedence] [tos tos] [log]
deny udp source source-wildcard [operator port [port]] destination destination-wildcard
[operator port [port]] [precedence precedence] [tos tos] [log]

source

Number of the network or host from which the packet is being sent. There are three alternative ways to specify the source:

Use a 32-bit quantity in four-part, dotted-decimal format.

Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended.

Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

source-wildcard

(Optional) Wildcard bits to be applied to the source. There are three alternative ways to specify the source wildcard:

Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore.

Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended.

Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

protocol

Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 through 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip. Some protocols allow further qualifiers described later.

destination

Number of the network or host to which the packet is being sent. There are three alternative ways to specify the destination:

Use a 32-bit quantity in four-part, dotted-decimal format.

Use the keyword any as an abbreviation for the destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended (see the section "Usage Guidelines").

Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

destination-wildcard

Wildcard bits to be applied to the destination. There are three alternative ways to specify the destination wildcard:

Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore.

Use the keyword any as an abbreviation for a destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended.

Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

precedence precedence

(Optional) Packets can be matched for encryption by precedence level, as specified by a number from 0 to 7 or by name.

tos tos

(Optional) Packets can be matched for encryption by type of service level, as specified by a number from 0 to 15 or by name.

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.

icmp-type

(Optional) ICMP packets can be matched for encryption by ICMP message type. The type is a number from 0 to 255.

icmp-code

(Optional) ICMP packets which are matched for encryption by ICMP message type can also be matched by the ICMP message code. The code is a number from 0 to 255.

icmp-message

(Optional) ICMP packets can be matched for encryption by an ICMP message type name or ICMP message type and code name.

igmp-type

(Optional) IGMP packets can be matched for encryption by IGMP message type or message name. A message type is a number from 0 to 15.

operator

(Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).

If the operator is positioned after the source and source-wildcard, it must match the source port.

If the operator is positioned after the destination and destination-wildcard, it must match the destination port.

The range operator requires two port numbers. All other operators require one port number.

port

(Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65,535. TCP and UDP port names are listed in the "Usage Guidelines" section of the access-list (encryption) command. TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP.

established

(Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection.

ip access-list extended (encryption)

To define an encryption access list by name, use the ip access-list extended global configuration command. Use the no form of this command to remove a named encryption access list.

name	Name of the encryption access list. Names cannot contain a space or quotation mark, and must begin with an alphabetic character to prevent ambiguity with numbered access lists.

ip access-list extended name
no ip access-list extended name

name

Name of the encryption access list. Names cannot contain a space or quotation mark, and must begin with an alphabetic character to prevent ambiguity with numbered access lists.

match address

To specify an extended access list for a crypto map entry, use the match address crypto map configuration command. Use the no form of this command to remove the extended access list from a crypto map entry.

access-list-id	(Optional) Identifies the extended access list by its name or number. This value should match the access-list-number or name argument of the extended access list being matched.
name	(Optional) Identifies the named encryption access list. This name should match the name argument of the named encryption access list being matched.

match address [access-list-id | name]
no match address [access-list-id | name]

access-list-id

(Optional) Identifies the extended access list by its name or number. This value should match the access-list-number or name argument of the extended access list being matched.

name

(Optional) Identifies the named encryption access list. This name should match the name argument of the named encryption access list being matched.

permit

To set conditions for a named encryption access list, use the permit access-list configuration command. The permit command causes IP traffic to be encrypted/decrypted if the conditions are matched. Use the no form of this command to remove a permit condition from an encryption access list.

source	Number of the network or host from which the packet is being sent. There are three alternative ways to specify the source: Use a 32-bit quantity in four-part, dotted-decimal format. Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.
source-wildcard	(Optional) Wildcard bits to be applied to the source. There are three alternative ways to specify the source wildcard: Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore. Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.
protocol	Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 through 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip. Some protocols allow further qualifiers described later.
destination	Number of the network or host to which the packet is being sent. There are three alternative ways to specify the destination: Use a 32-bit quantity in four-part, dotted-decimal format. Use the keyword any as an abbreviation for the destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.
destination-wildcard	Wildcard bits to be applied to the destination. There are three alternative ways to specify the destination wildcard: Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore. Use the keyword any as an abbreviation for a destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended. Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.
precedence precedence	(Optional) Packets can be matched for encryption by precedence level, as specified by a number from 0 to 7 or by name.
tos tos	(Optional) Packets can be matched for encryption by type of service level, as specified by a number from 0 to 15 or by name.
log	(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.) The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.
icmp-type	(Optional) ICMP packets can be matched for encryption by ICMP message type. The type is a number from 0 to 255.
icmp-code	(Optional) ICMP packets which are matched for encryption by ICMP message type can also be matched by the ICMP message code. The code is a number from 0 to 255.
icmp-message	(Optional) ICMP packets can be matched for encryption by an ICMP message type name or ICMP message type and code name.
igmp-type	(Optional) IGMP packets can be matched for encryption by IGMP message type or message name. A message type is a number from 0 to 15.
operator	(Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range). If the operator is positioned after the source and source-wildcard, it must match the source port. If the operator is positioned after the destination and destination-wildcard, it must match the destination port. The range operator requires two port numbers. All other operators require one port number.
port	(Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535. TCP and UDP port names are listed in the "Usage Guidelines" section of the access-list (extended) command. TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP.
established	(Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection.

permit source [source-wildcard]
no permit source [source-wildcard]
permit protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log]
no permit protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log]
permit icmp source source-wildcard destination destination-wildcard [icmp-type [icmp-code] |
icmp-message] [precedence precedence] [tos tos] [log]
permit igmp source source-wildcard destination destination-wildcard [igmp-type]
[precedence precedence] [tos tos] [log]
permit tcp source source-wildcard [operator port [port]] destination destination-wildcard
[operator port [port]] [established] [precedence precedence] [tos tos] [log]
permit udp source source-wildcard [operator port [port]] destination destination-wildcard
[operator port [port]] [precedence precedence] [tos tos] [log]

source

Number of the network or host from which the packet is being sent. There are three alternative ways to specify the source:

Use a 32-bit quantity in four-part, dotted-decimal format.

Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended.

Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

source-wildcard

(Optional) Wildcard bits to be applied to the source. There are three alternative ways to specify the source wildcard:

Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore.

Use the keyword any as an abbreviation for a source and source-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended.

Use host source as an abbreviation for a source and source-wildcard of source 0.0.0.0.

protocol

Name or number of an IP protocol. It can be one of the keywords eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 through 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip. Some protocols allow further qualifiers described later.

destination

Number of the network or host to which the packet is being sent. There are three alternative ways to specify the destination:

Use a 32-bit quantity in four-part, dotted-decimal format.

Use the keyword any as an abbreviation for the destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended.

Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

destination-wildcard

Wildcard bits to be applied to the destination. There are three alternative ways to specify the destination wildcard:

Use a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore.

Use the keyword any as an abbreviation for a destination and destination-wildcard of 0.0.0.0 255.255.255.255. This keyword is normally not recommended.

Use host destination as an abbreviation for a destination and destination-wildcard of destination 0.0.0.0.

precedence precedence

(Optional) Packets can be matched for encryption by precedence level, as specified by a number from 0 to 7 or by name.

tos tos

(Optional) Packets can be matched for encryption by type of service level, as specified by a number from 0 to 15 or by name.

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

The message includes the access list number, whether the packet was permitted or denied; the protocol, whether it was TCP, UDP, ICMP or a number; and, if appropriate, the source and destination addresses and source and destination port numbers. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.

icmp-type

(Optional) ICMP packets can be matched for encryption by ICMP message type. The type is a number from 0 to 255.

icmp-code

(Optional) ICMP packets which are matched for encryption by ICMP message type can also be matched by the ICMP message code. The code is a number from 0 to 255.

icmp-message

(Optional) ICMP packets can be matched for encryption by an ICMP message type name or ICMP message type and code name.

igmp-type

(Optional) IGMP packets can be matched for encryption by IGMP message type or message name. A message type is a number from 0 to 15.

operator

(Optional) Compares source or destination ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range).

If the operator is positioned after the source and source-wildcard, it must match the source port.

If the operator is positioned after the destination and destination-wildcard, it must match the destination port.

The range operator requires two port numbers. All other operators require one port number.

port

(Optional) The decimal number or name of a TCP or UDP port. A port number is a number from 0 to 65535. TCP and UDP port names are listed in the "Usage Guidelines" section of the access-list (extended) command. TCP port names can only be used when filtering TCP. UDP port names can only be used when filtering UDP.

established

(Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bits set. The nonmatching case is that of the initial TCP datagram to form a connection.

set algorithm 40-bit-des

To specify a 40-bit Data Encryption Standard (DES) algorithm type within a crypto map definition, use the set algorithm 40-bit-des crypto map configuration command. Use the no form of this command to disable a 40-bit DES algorithm type within a crypto map definition.

cfb-8	(Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the 40-bit DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default.
cfb-64	(Optional) Selects the 64-bit CFB mode of the 40-bit DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default.

set algorithm 40-bit-des [cfb-8 | cfb-64]
no set algorithm 40-bit-des [cfb-8 | cfb-64]

cfb-8

(Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the 40-bit DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default.

cfb-64

(Optional) Selects the 64-bit CFB mode of the 40-bit DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default.

set algorithm des

To enable basic Data Encryption Standard (DES) algorithm types within a crypto map definition, use the set algorithm des crypto map configuration command. Use the no form of this command to disable a basic DES algorithm type within a crypto map definition.

cfb-8	(Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the basic DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default.
cfb-64	(Optional) Selects the 64-bit CFB mode of the basic DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default.

set algorithm des [cfb-8 | cfb-64]
no set algorithm des [cfb-8 | cfb-64]

cfb-8

(Optional) Selects the 8-bit Cipher FeedBack (CFB) mode of the basic DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default.

cfb-64

(Optional) Selects the 64-bit CFB mode of the basic DES algorithm. If no CFB mode is specified when the command is issued, 64-bit CFB mode is the default.

set peer

To specify a peer encrypting router within a crypto map definition, use the set peer crypto map configuration command. Use the no form of this command to eliminate a peer encrypting router from a crypto map definition.

key-name	Identifies the crypto engine of the peer encrypting router.

set peer key-name
no set peer key-name

key-name

Identifies the crypto engine of the peer encrypting router.

show crypto algorithms

The show crypto cisco algorithms command replaces this command. Refer to the description of the show crypto cisco algorithms command in this chapter for further information.

show crypto card

To view the operational status of an Encryption Service Adapter (ESA), use the show crypto card privileged EXEC command. This command is available only on Cisco 7200, RSP7000, or 7500 series routers with an installed ESA.

slot	(Optional) This argument is available only on Cisco 7200, RSP7000, and 7500 series routers. Identifies the ESA to show. Use the chassis slot number of the VIP2 containing the ESA.
vip	(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

show crypto card [slot | vip]

slot

(Optional) This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.

Identifies the ESA to show. Use the chassis slot number of the VIP2 containing the ESA.

vip

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

show crypto cisco algorithms

To view which Data Encryption Standard (DES) algorithm types are globally enabled for your router, use the show crypto cisco algorithms privileged EXEC command. This displays all basic DES and 40-bit DES algorithm types globally enabled.

show crypto cisco algorithms

show crypto cisco connections

To view current and pending encrypted session connections, use the show crypto cisco connections privileged EXEC command.

show crypto cisco connections

show crypto cisco key-timeout

To view the current setting for the duration of encrypted sessions, use the show crypto cisco key-timeout privileged EXEC command.

show crypto cisco key-timeout

show crypto cisco pregen-dh-pairs

To view the number of Diffie-Hellman (DH) number pairs currently generated, use the show crypto cisco pregen-dh-pairs privileged EXEC command.

show crypto cisco pregen-dh-pairs [slot | rsm | vip]

slot

(Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.

If no slot is specified, the Cisco IOS crypto engine will be selected.

Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500).

rsm

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Route Switch Module on the Cisco Catalyst 5000 series switch.

vip

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

show crypto connections

The show crypto cisco connections command replaces this command. Refer to the description of the show crypto cisco connections command in this chapter for further information.

show crypto engine brief

To view all crypto engines within a Cisco 7200, RSP7000, or 7500 series router, use the show crypto engine brief privileged EXEC command.

show crypto engine brief

show crypto engine configuration

To view the Cisco IOS crypto engine of your router, use the show crypto engine configuration privileged EXEC command.

show crypto engine configuration

show crypto engine connections active

To view the current active encrypted session connections for all crypto engines, use the show crypto engine connections active privileged EXEC command.

show crypto engine connections active [slot | rsm | vip]

slot

(Optional) Identifies the crypto engine. This argument is available only on Cisco 7200, RSP7000, and 7500 series routers.

If no slot is specified, the Cisco IOS crypto engine will be selected.

Use the chassis slot number of the crypto engine location. For the Cisco IOS crypto engine, this is the chassis slot number of the Route Switch Processor (RSP). For the VIP2 crypto engine, this is the chassis slot number of the VIP2. For the ESA crypto engine, this is the chassis slot number of the ESA (Cisco 7200) or of the VIP2 (Cisco RSP7000 and 7500).

rsm

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Route Switch Module on the Cisco Catalyst 5000 series switch.

vip

(Optional) This keyword is only available on the Cisco Catalyst 5000 series switch. It identifies the Versatile Interface Processor on the Cisco Catalyst 5000 series switch.

show crypto engine connections dropped-packets

To view information about packets dropped during encrypted sessions for all router crypto engines, use the show crypto engine connections dropped-packets privileged EXEC command.

show crypto engine connections dropped-packets

show crypto key mypubkey dss

To view Digital Signature Standard (DSS) public keys (for all your router crypto engines) in hexadecimal form, use the show crypto key mypubkey dss EXEC command.

show crypto key mypubkey dss

show crypto key pubkey-chain dss

To view peer router Digital Signature Standard (DSS) public keys known to your router, use the show crypto key pubkey-chain dss EXEC command.

show crypto key pubkey-chain dss [name key-name | serial serial-number]

key-name

(Optional) The name assigned when the DSS public key was created with the crypto key pubkey-chain dss command.

serial-number

(Optional) The serial number of the encrypting router's public DSS key.

show crypto key-timeout

The show crypto cisco key-timeout command replaces this command. Refer to the description of the show crypto cisco key-timeout command in this chapter for further details.

show crypto map

To view the crypto map configuration, use the show crypto map privileged EXEC command.

show crypto map [interface interface | tag map-name]

interface interface

(Optional) Shows only the crypto map set applied to the specified interface.

tag map-name

(Optional) Shows only the crypto map set with the specified map-name.

show crypto mypubkey

The show crypto key mypubkey dss command replaces this command. Refer to the description of the show crypto key mypubkey dss command in this chapter for further details.

show crypto pregen-dh-pairs

The show crypto cisco pregen-dh-pairs command replaces this command. Refer to the description of the show crypto cisco pregen-dh-pairs command for more information.

show crypto pubkey

The show crypto key pubkey-chain dss command replaces this command. Refer to the description of the show crypto key pubkey-chain dss command in this chapter for further details.

show crypto pubkey name

The show crypto key pubkey-chain dss command replaces this command. Refer to the description of the show crypto key pubkey-chain dss command in this chapter for further details.

show crypto pubkey serial

The show crypto key pubkey-chain dss command replaces this command. Refer to the description of the show crypto key pubkey-chain dss command in this chapter for further details.

test crypto initiate-session

To set up a test encryption session, use the test crypto initiate-session privileged EXEC command.

test crypto initiate-session src-ip-addr dst-ip-addr map-name seq-num

src-ip-addr

IP address of source host. Should be included in an encryption access list definition as a valid IP address source address.

dst-ip-addr

IP address of destination host. Should be included in an encryption access list definition as a valid IP address destination address.

map-name

Names the crypto map to be used.

seq-num

Names the crypto map sequence number.

key-name	(Optional) The name assigned when the DSS public key was created with the crypto key pubkey-chain dss command.
serial-number	(Optional) The serial number of the encrypting router's public DSS key.

interface interface	(Optional) Shows only the crypto map set applied to the specified interface.
tag map-name	(Optional) Shows only the crypto map set with the specified map-name.

src-ip-addr	IP address of source host. Should be included in an encryption access list definition as a valid IP address source address.
dst-ip-addr	IP address of destination host. Should be included in an encryption access list definition as a valid IP address destination address.
map-name	Names the crypto map to be used.
seq-num	Names the crypto map sequence number.

Table of Contents

Cisco Encryption Technology Commands