Downloads |
Table Of Contents
Tunnel Endpoint Discovery Enhancement
Related Features and Technologies
Supported Standards, MIBs, and RFCs
Configuring Tunnel Endpoint Discovery
Verifying Tunnel Endpoint Discovery
crypto map (global configuration)
Tunnel Endpoint Discovery Enhancement
This feature module describes the Tunnel Endpoint Discovery (TED) feature. It includes information on the benefits of the new feature, supported platforms, and related documents.
This document includes the following sections:
•
Supported Standards, MIBs, and RFCs
Feature Overview
Tunnel Endpoint Discovery (TED) is an enhancement to the IP Security (IPSec) feature. Defining a dynamic crypto map allows you to be able to dynamically determine an IPSec peer; however, only the receiving router has this ability. With TED, the initiating router can dynamically determine an IPSec peer for secure IPSec communications.
To have a large, fully-meshed network without TED, each peer needs to have static crypto maps to every other peer in the network. For example, if there are 100 peers in a large, fully-meshed network, each router needs 99 static crypto maps for each of its peers. With TED, only a single dynamic crypto map with TED enabled is needed because the peer is discovered dynamically. Thus, static crypto maps do not need to be configured for each peer.
Note
and the corresponding steps explain a sample TED network topology:
Step 1
Step 2
Step 3
Step 4
Note
Figure 1 Tunnel Endpoint Discovery Sample Network Topology
Benefits
Dynamic TED helps to simplify IPSec configuration on the individual routers within a large network. Each node has a simple configuration that defines the local network that the router is protecting and the required IPSec transforms.
Restrictions
Tunnel Endpoint Discovery has the following restrictions:
•
•
•
Note
•
•
CautionCisco IOS images with strong encryption (including, but not limited to, 56-bit data encryption feature sets) are subject to United States government export controls, and have a limited distribution. Images to be installed outside the United States require an export license. Customer orders might be denied or subject to delay due to United States government regulations. Contact your sales representative or distributor for more information, or send e-mail to export@cisco.com.
Related Features and Technologies
The TED feature is related to the existing IPSec and IKE features, which are documented in the Cisco IOS Release 12.0 Security Configuration Guide and Cisco IOS Release 12.0 Security Command Reference.
Related Documents
For related information on the TED feature, refer to the following documents:
•
•
Supported Platforms
TED runs on all platforms that support Cisco IOS Release 12.0(5)T and later releases with IPSec, including, but not limited to, the following platforms:
•
•
•
•
•
•
•
•
•
•
Supported Standards, MIBs, and RFCs
MIBs
No new MIBs are supported by this feature.
For descriptions of supported MIBs and how to use MIBs, see Cisco's MIB web site on CCO at http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml.
RFCs
RFC 2409, The Internet Key Exchange (IKE)
Standards
No new standards are supported by this feature.
Prerequisites
Before configuring Tunnel Endpoint Discovery, you must have an IPSec software image that supports the Tunnel Endpoint Discovery feature downloaded on to your router. For more information on downloading a software image, see the following publications:
•
•
Configuration Tasks
To configure a Cisco router to support Tunnel Endpoint Discovery, perform the following tasks:
•
•
Configuring Tunnel Endpoint Discovery
To create a dynamic crypto map entry with Tunnel Endpoint Discovery configured, perform the following tasks starting in crypto-map configuration mode:
Verifying Tunnel Endpoint Discovery
Step 1
Step 2
HostB# ping 2.2.2.5Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 2.2.2.5, timeout is 2 seconds:.!!!!Success rate is 80 percent (4/5), round-trip min/avg/max = 12/12/12 msConfiguration Examples
This section provides the following configuration example:
TED Configuration Example
The following example shows how to configure TED:
crypto dynamic map ted-map 10set transform-set ted-transformsmatch address 101set security-assocation lifetime seconds 2700!crypto map tedtag 10 ipsec-isakmp dynamic ted-map discoverCommand Reference
This section documents modified commands. All other commands used to configure this feature are documented in the Cisco IOS Release 12.0 command reference publications.
•
crypto map (global configuration)
To create or modify a crypto map entry and enter the crypto map configuration mode, use the crypto map global configuration command. Use the no form of this command to delete a crypto map entry or set.
[no] crypto map map-name seq-num [cisco]
[no] crypto map map-name seq-num ipsec-manual
[no] crypto map map-name seq-num ipsec-isakmp [dynamic dynamic-map-name] [discover]
Syntax Description
Defaults
No crypto maps exist.
Peer discovery is not enabled.
Command Modes
Global configuration. Using this command puts you into crypto map configuration mode, unless you use the dynamic keyword.
Command History
Examples
The following example shows how to configure TED:
crypto dynamic map ted-map 10set transform-set ted-transformsmatch address 101set security-assocation lifetime seconds 2700!crypto map tedtag 10 ipsec-isakmp dynamic ted-map discoverRelated Commands
Glossary
AH—Authentication Header. A security protocol which provides data authentication and optional anti-replay services. AH is embedded in the data to be protected (a full IP datagram).
Authentication Header—See AH.
ESP—Encapsulating Security Payload. A security protocol which provides data privacy services and optional data authentication, and anti-replay services. ESP encapsulates the data to be protected.
Encapsulating Security Payload—See ESP.
Dynamic crypto map—Dynamic crypto maps are only available for use by IKE. A dynamic crypto map entry is a crypto map entry without all the parameters configured. It acts as a policy template where the missing parameters are later dynamically configured (as the result of an IPSec negotiation) to match a remote peer's requirements. This allows remote peers to exchange IPSec traffic with the router even if the router does not have a crypto map entry specifically configured to meet all of the remote peer's requirements.
IP Security Protocol—See IPSec.
IPSec—IP Security Protocol. A framework of open standards that provides data confidentiality, data integrity, and data authentication between participating peers. IPSec provides these security services at the IP layer; it uses IKE to handle negotiation of protocols and algorithms based on local policy and to generate the encryption and authentication keys to be used by IPSec. IPSec can be used to protect one or more data flows between a pair of hosts, between a pair of security gateways, or between a security gateway and a host.
IKE—Internet Key Exchange. A key management protocol standard which is used in conjunction with the IPSec standard. IPSec is an IP security feature that provides robust authentication and encryption of IP packets. IPSec can be configured without IKE, but IKE enhances IPSec by providing additional features, flexibility, and ease of configuration for the IPSec standard. IKE is a hybrid protocol which implements the Oakley key exchange and Skeme key exchange inside the Internet Security Association and Key Management Protocol (ISAKMP) framework. (ISAKMP, Oakley, and Skeme are security protocols implemented by IKE.)
Internet Key Exchange—See IKE.
Probe—A packet designated by the router to discover the identity of a tunnel endpoint.
