Usage Information • IPv4 addresses support only -/32 mask types.• IPv6 addresses support only -/128 mask types.• Configure match for bi-directional traffic for optimal routing.• Only TCP is supported.Example match 0 tcp a::1 /128 0 a::2 /128 23match 1 tcp a::1 /128 23 a::2 /128 0match 2 tcp a::1 /128 0 a::2 /128 21match 3 tcp a::1 /128 21 a::2 /128 0match 4 tcp 1.1.1.1 /32 0 1.1.1.2 /32 23match 5 tcp 1.1.1.1 /32 23 1.1.1.2 /32 0match 6 tcp 1.1.1.1 /32 0 1.1.1.2 /32 21match 7 tcp 1.1.1.1 /32 21 1.1.1.2 /32 0session-keySpecify the session keys used in the crypto policy entry.C9000 SeriesSyntax session-key {inbound | outbound} {ah spi hex-key-string | esp spiencrypt hex-key-string auth hex-key-stringTo delete the session key information from the crypto policy, use the no session-key {inbound | outbound} {ah | esp} command.Parameters name Enter the name for the transform set.inbound Specify the inbound session key for IPSec.outbound Specify the outbound session key for IPSec.ah Use the AH protocol when you select the AH transform set inthe crypto policy.esp Use the ESP protocol when you select the ESP transform set inthe crypto policy.spi Enter the security parameter index number.hex-key-string Enter the session key in hex format (a string of 8, 16, or 20bytes). For DES algorithms, specify at least 16 bytes per key. ForSHA algorithms, specify at least 20 bytes per key.encrypt Indicates the ESP encryption transform set key string.auth Indicates the ESP authentication transform set key string.Internet Protocol Security (IPSec) 1160
