Comment
Author: Admin | 2025-04-28
Peer. (Negotiation applies only to ipsec-isakmp crypto map entries.) The peer must permit a data flow associated with an ipsec-isakmp crypto map command entry to ensure acceptance during negotiation. Note If you delete the only element in an ACL, the ASA also removes the associated crypto map. If you modify an ACL currently referenced by one or more crypto maps, use the crypto map interface command to reinitialize the run-time SA database. See the crypto map command for more information. We recommend that for every crypto ACL specified for a static crypto map that you define at the local peer, you define a “mirror image” crypto ACL at the remote peer. The crypto maps should also support common transforms and refer to the other system as a peer. This ensures correct processing of IPsec by both peers. Note Every static crypto map must define an ACL and an IPsec peer. If either is missing, the crypto map is incomplete and the ASA drops any traffic that it has not already matched to an earlier, complete crypto map. Use the show conf command to ensure that every crypto map is complete. To fix an incomplete crypto map, remove the crypto map, add the missing entries, and reapply it. We discourage the use of the any keyword to specify source or destination addresses in crypto ACLs because they cause problems. We strongly discourage the permit any any command statement because it does the following: Protects all outbound traffic, including all protected traffic
Add Comment