![background image](http://html.mh-extra.com/html/cisco/5505-asa-firewall-edition-bundle/5505-asa-firewall-edition-bundle_cli-configuration-manual_186241699.webp)
1-65
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Group Policies
Step 3
Specify whether to require that users reauthenticate on IKE re-key by using the
re-xauth
command with
the
enable
keyword in group-policy configuration mode.
Note
IKE re-key is not supported for IKEv2 connections.
If you enable reauthentication on IKE re-key, the ASA prompts the user to enter a username and
password during initial Phase 1 IKE negotiation and also prompts for user authentication whenever an
IKE re-key occurs. Reauthentication provides additional security.
If the configured re-key interval is very short, users might find the repeated authorization requests
inconvenient. To avoid repeated authorization requests, disable reauthentication. To check the
configured re-key interval, in monitoring mode, enter the
show crypto ipsec sa
command to view the
security association lifetime in seconds and lifetime in kilobytes of data. To disable user reauthentication
on IKE re-key, enter the
disable
keyword. Reauthentication on IKE re-key is disabled by default.
hostname(config-group-policy)#
re-xauth
{
enable | disable
}
hostname(config-group-policy)#
To enable inheritance of a value for reauthentication on IKE re-key from another group policy, remove
the re-xauth attribute from the running configuration by entering the
no
form of this command:
hostname(config-group-policy)#
no re-xauth
hostname(config-group-policy)#
Note
Reauthentication fails if there is no user at the other end of the connection.
Step 4
Specify whether to enable perfect forward secrecy. In IPsec negotiations, perfect forward secrecy
ensures that each new cryptographic key is unrelated to any previous key. A group policy can inherit a
value for perfect forward secrecy from another group policy. Perfect forward secrecy is disabled by
default. To enable perfect forward secrecy, use the
pfs
command with the
enable
keyword in
group-policy configuration mode.
hostname(config-group-policy)#
pfs
{
enable
|
disable
}
hostname(config-group-policy)#
To disable perfect forward secrecy, enter the
pfs
command with the
disable
keyword.
To remove the perfect forward secrecy attribute from the running configuration and prevent inheriting a
value, enter the
no
form of this command.
hostname(config-group-policy)#
no pfs
hostname(config-group-policy)#
Configuring IPsec-UDP Attributes for IKEv1 Clients
IPsec over UDP, sometimes called IPsec through NAT, lets a Cisco VPN client or hardware client
connect via UDP to a ASA that is running NAT. It is disabled by default. IPsec over UDP is proprietary;
it applies only to remote-access connections, and it requires mode configuration. The ASA exchanges
configuration parameters with the client while negotiating SAs. Using IPsec over UDP may slightly
degrade system performance.
To enable IPsec over UDP, configure the
ipsec-udp
command with the
enable
keyword in group-policy
configuration mode, as follows:
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......