| 14.5 |  | Task 3 - Configure IPSec Parameters |
| 14.5.3 |  | Step 2 - configure an IPSec transform set |

| A transform set is an acceptable combination of security protocols, algorithms, and other settings to apply to IPSec-protected traffic. During the IPSec security association negotiation, the peers agree to use a particular transform set when protecting a particular data flow. Each transform represents an IPSec security protocol such as ESP, AH, or both, and the algorithm used for encryption or authentication .

Multiple transform sets can be configured on a PIX and these transform sets are included in a crypto map entry. The transform set defined in the crypto map entry will be used in the IPSec SA negotiation to protect the data flows specified by the ACL of that crypto map entry.

A transform set equals an AH transform and an ESP transform plus the transport or tunnel mode. Transform sets are limited to one AH and two ESP transforms. The default mode is tunnel. Be sure to configure matching transform sets between IPSec peers.

A sample transform set is shown below:

> crypto ipsec transform-set MYSET esp-des esp-md5-hmac

| Lab Activity e-Lab Activity: IPSec Transform Set In this activity, the student will set a transform set at pix1 and a duplicate transform set at pix2, which will be applied to the protected traffic as part of both peers' IPSec security associations.