| 1 5.5 |  | Using PDM to Create Site-to-Site VPNs |
| 15.5.7 |  | Creating an IPSec rule |

| IPSec-related screens are grouped under the IPSec branch of the Categories tree. To select traffic to be protected by IPSec, select IPSec Rules from the IPSec branch. Right-click within the IPSec Rules table and choose Add from the dropdown menu. The Add Rules panel opens. This panel consists of a table similar to the Access Rule panel. This is where traffic that is to be protected is selected. When applied to the PIX Security Appliance, the rule that has been created is implemented by attaching an ACL to a crypto map.

In the Add Rule panel, the action choices are protect and do not protect, rather than permit or deny. Use the PIX Side Host/Network and Remote Side Host/Network group boxes to select the traffic to be protected. Like the Access Rule table, PDM displays the real IP addresses of the hosts and networks. The ACL, however, may show translated addresses depending on the current NAT configuration and where the crypto map is applied.

At the bottom of the panel is the Exempt from address translation check box. If selected, the PDM generates nat 0 match acl commands to allow IPSec traffic to bypass the NAT engine. This check box is selected by default.

The Tunnel Policy group box in the top right corner is used to attach the traffic selection rule to a tunnel policy. This is the equivalent of attaching an ACL to a crypto map. The New button provides a shortcut for defining a new tunnel policy without leaving the Add Rule panel.

A network administrator can add, edit, and delete traffic selector rules by using the main Rules menu or the buttons in the toolbar, or by right clicking within the table. It is also possible to cut, copy, and paste rules between the Access Rule table, NAT Exemption Rule table, and IPSec Rule table.