| 14.5 |  | Task 3 - Configure IPSec Parameters |
| 14.5.1 |  | Step 1 - configure interesting traffic |

| Crypto access-control lists (ACLs) are used to determine traffic that will be part of the IPSec tunnel. If traffic matches the permit statement within a crypto ACL, this traffic is termed as interesting traffic. Crypto ACLs perform the following functions :

- Indicate the data flow to be protected by IPSec
- Select outbound traffic to be protected by IPSec
- Process inbound traffic in order to filter out and discard traffic that should be protected by IPSec
- Determine whether or not to accept requests for IPSec SAs for the requested data flows when processing IKE negotiations

Use the following command to configure interesting traffic with crypto ACLs:

> pixfirewall(config)# access-list acl_ID {deny | permit} protocol source_addr source_mask destination_addr destination_mask

Any unprotected inbound traffic that matches a permit entry in the ACL for a crypto map entry flagged as IPSec will be dropped because it is expected that IPSec protected this traffic.

If different IPSec traffic is to receive different IPSec protection, such as authentication only versus encryption only, two different crypto ACLs must be used to define the two different types of traffic. These different ACLs are used in different crypto map entries, which specify different IPSec policies.

Try to be as restrictive as possible when defining which packets to protect in a crypto ACL. If it is necessary to use the any keyword in a permit statement, it must be prefaced with a series of deny statements to filter out any undesired traffic that could fall within that permit statement.

| Media Activity Demonstration Activity: Configure Interesting Traffic In this activity, students will learn to configure crypto maps.