Cisco ASA Series User Manual

1-5
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring LAN-to-LAN IPsec VPNs
Configuring ISAKMP Policy and Enabling ISAKMP on the Outside Interface
hostname(config-ikev1-policy)# authentication pre-share
hostname(config-ikev1-policy)#
Step 3 Set the encryption method. The following example configures 3DES:
hostname(config-ikev1-policy)# encryption 3des
hostname(config-ikev1-policy)#
Step 4 Set the HMAC method. The following example configures SHA-1:
hostname(config-ikev1-policy)# hash sha
hostname(config-ikev1-policy)#
Step 5 Set the Diffie-Hellman group. The following example configures Group 2:
hostname(config-ikev1-policy)# group 2
hostname(config-ikev1-policy)#
Step 6 Set the encryption key lifetime. The following example configures 43,200 seconds (12 hours):
hostname(config-ikev1-policy)# lifetime 43200
hostname(config-ikev1-policy)#
Step 7 Enable IKEv1 on the interface named outside in either single or multiple context mode:
hostname(config)# crypto ikev1 enable outside
hostname(config)#
Step 8 To save your changes, enter the write memory command:
hostname(config)# write memory
hostname(config)#
Configuring ISAKMP Policies for IKEv2 Connections
To configure ISAKMP policies for IKEv2 connections, use the crypto ikev2 policy priority command
to enter IKEv2 policy configuration mode where you can configure the IKEv2 parameters.
Perform the following steps:
Step 1 Enter IPsec IKEv2 policy configuration mode. For example:
hostname(config)# crypto ikev2 policy 1
hostname(config-ikev2-policy)#
Step 2 Set the encryption method. The following example configures 3DES:
hostname(config-ikev2-policy)# encryption 3des
hostname(config-ikev2-policy)#
Step 3 Set the Diffie-Hellman group. The following example configures Group 2:
hostname(config-ikev2-policy)# group 2
hostname(config-ikev2-policy)#
Step 4 Set the pseudo-random function (PRF) used as the algorithm to derive keying material and hashing
operations required for the IKEv2 tunnel encryption. The following example configures SHA-1 (an
HMAC variant):
hostname(config-ikev12-policy)# prf sha
hostname(config-ikev2-policy)#

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English