![background image](http://html.mh-extra.com/html/cisco/5505-asa-firewall-edition-bundle/5505-asa-firewall-edition-bundle_cli-configuration-manual_186241800.webp)
1-4
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring LAN-to-LAN IPsec VPNs
Configuring ISAKMP Policy and Enabling ISAKMP on the Outside Interface
Configuring ISAKMP Policy and Enabling ISAKMP on the
Outside Interface
ISAKMP is the negotiation protocol that lets two hosts agree on how to build an IPsec security
association (SA). It provides a common framework for agreeing on the format of SA attributes. This
includes negotiating with the peer about the SA, and modifying or deleting the SA. ISAKMP separates
negotiation into two phases: Phase 1 and Phase 2. Phase 1 creates the first tunnel, which protects later
ISAKMP negotiation messages. Phase 2 creates the tunnel that protects data.
IKE uses ISAKMP to setup the SA for IPsec to use. IKE creates the cryptographic keys used to
authenticate peers.
The ASA supports IKEv1 for connections from the legacy Cisco VPN client, and IKEv2 for the
AnyConnect VPN client.
To set the terms of the ISAKMP negotiations, you create an IKE policy, which includes the following:
•
The authentication type required of the IKEv1 peer, either RSA signature using certificates or
preshared key (PSK).
•
An encryption method, to protect the data and ensure privacy.
•
A Hashed Message Authentication Codes (HMAC) method to ensure the identity of the sender, and
to ensure that the message has not been modified in transit.
•
A Diffie-Hellman group to determine the strength of the encryption-key-determination algorithm.
The ASA uses this algorithm to derive the encryption and hash keys.
•
For IKEv2, a separate pseudo-random function (PRF) used as the algorithm to derive keying
material and hashing operations required for the IKEv2 tunnel encryption, etc.
•
A limit to the time the ASA uses an encryption key before replacing it.
With IKEv1 policies, for each parameter, you set one value. For IKEv2, you can configure multiple
encryption and authentication types, and multiple integrity algorithms for a single policy. The ASA
orders the settings from the most secure to the least secure and negotiates with the peer using that order.
This allows you to potentially send a single proposal to convey all the allowed transforms instead of the
need to send each allowed combination as with IKEv1.
The following sections provide procedures for creating IKEv1 and IKEv2 policies and enabling them on
an interface:
•
Configuring ISAKMP Policies for IKEv1 Connections, page 1-4
•
Configuring ISAKMP Policies for IKEv2 Connections, page 1-5
Configuring ISAKMP Policies for IKEv1 Connections
To configure ISAKMP policies for IKEv1 connections, use the
crypto ikev1 policy
priority
command
to enter IKEv1 policy configuration mode where you can configure the IKEv1 parameters.
Perform the following steps and use the command syntax in the following examples as a guide.
Step 1
Enter IPsec IKEv1 policy configuration mode. For example:
hostname(config)#
crypto ikev1 policy 1
hostname(config-ikev1-policy)#
Step 2
Set the authentication method. The following example configures a preshared key:
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......