What is Crypto Map?

Understanding Crypto Map

A crypto map is a Cisco IOS configuration construct used to build IPsec VPN connections. It binds together the parameters needed for a secure tunnel — the remote peer address, the transform set defining encryption and authentication algorithms, and an access control list specifying which traffic to protect — into a named, ordered policy that is then applied to an interface.

It works by linking IPsec phase 2 components. Each crypto map entry references a transform set (for example ESP with AES and SHA), a "match address" ACL that defines interesting traffic to encrypt, and the peer that terminates the tunnel; IKE (phase 1) negotiates the secure channel first. When traffic matches the ACL on an interface carrying the crypto map, the router triggers IKE negotiation if needed, establishes IPsec security associations, and encrypts the flow. Entries are processed in sequence-number order, allowing multiple peers and policies under one map.

It matters for security because the crypto map is where confidentiality and integrity policy is concretely enforced for site-to-site and remote-access VPNs. Misconfiguration directly weakens protection: an overly broad ACL may encrypt the wrong traffic or leave sensitive flows in the clear, weak transform sets (DES, MD5) expose data to cryptanalysis, and mismatched parameters between peers silently break the tunnel. Crypto maps are a traditional approach; newer designs often favor tunnel interfaces (VTIs) for cleaner routing, but crypto maps remain widespread in existing deployments.

For example, a network engineer connecting a branch office to headquarters defines an ACL matching the two sites' subnets, a transform set using ESP-AES-256 and SHA, and a crypto map entry naming the HQ peer and referencing both. Applying that crypto map to the branch router's WAN interface means any traffic between the offices automatically triggers IKE, builds an encrypted IPsec tunnel, and protects the data as it crosses the internet.