ccna book greek

ccna book greek.A transform set is a collection of individual IPSec transforms used to enforce a specific security policy on traffic. In the ISAKMPIPSec SA negotiation that occurs in IKE Phase 2 Fast Mode, the peers agree to use a specific transform set to protect a specific data flow.The transform set consists of an AH transform, an ESP transform, and the IPSec mode (tunnel mode or transport mode). The transform set is limited to one AH transform and one or two ESP transforms. Multiple transform sets can be configured. One or more such transform sets can be specified in a single cryptographic mapping entry. The IPSec SA negotiates to use the transform set defined in the cryptographic mapping entry to protect the data stream specified by the ACL for that cryptographic mapping entry.To define a transform set, use the global configuration mode command cryptoipsectransform-set to specify 1.4 transforms. This command activates the encryption transform (crypto.transform) configuration mode.Each transform represents an IPSec security policy (AH or ESP) plus the associated algorithms that are specified in the crypto. Transform configuration mode. In a transform set, specify the AH protocol, the ESP protocol, or both. If an ESP protocol is specified in a transform set, an ESP encryption transform set or an ESP encryption transform set and an ESP authentication transform set must be specified.During negotiation, the two peers look for a transform set that has the same criteria (combination of protocols, algorithms, and other settings) on both sides.When a transform set is found, it is selected as part of the two-peer IPSec SA and applied to the traffic being protected. If ISAKMP is not used to create the SA, a transform set must be used. In this case, the transform set is not negotiated.8.4.4.2 Configuring a Transformation SetTransformation sets are negotiated in IKE phase 2 fast mode. When multiple transform sets are configured, from most secure to least secure, depending on the network security policy8.4 Implementing Site-to-Site IPSecVPN Using the CLI 237to configure the transformations.