64-2
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter64 Configuring IPsec and ISAKMP
Information About Tunneling, IPsec, and ISAKMP
The ASA functions as a bidirectional tunnel endpoint. It can receive plain packets from the private
network, encapsulate them, create a tunnel, and send them to the other end of the tunnel where they are
unencapsulated and sent to their final destination. It can also receive encapsulated packets from the
public network, unencapsulate them, and send them to their final destination on the private network.
IPsec Overview
The ASA uses IPsec for LAN-to-LAN VPN connections and provides the option of using IPsec for
client-to-LAN VPN connections. In IPsec terminology, a peer is a remote-access client or another secure
gateway. For both connection types, the ASA supports only Cisco peers. Because we adhere to VPN
industry standards, ASAs can work with other vendors' peers; however, we do not support them.
During tunnel establishment, the two peers negotiate security associations that govern authentication,
encryption, encapsulation, and key management. These negotiations involve two phases: first, to
establish the tunnel (the IKE SA) and second, to govern traffic within the tunnel (the IPsec SA).
A LAN-to-LAN VPN connects networks in different geographic locations. In IPsec LAN-to-LAN
connections, the ASA can function as initiator or responder. In IPsec client-to-LAN connections, the
ASA functions only as responder. Initiators propose SAs; responders accept, reject, or make
counter-proposals—all in accordance with configured SA parameters. To establish a connection, both
entities must agree on the SAs.
Note When the ASA is configured for IPsec VPN, you cannot enable security contexts (also called firewall
multimode) or Active/Active stateful failover. Therefore, these features are unavailable.
ISAKMP and IKE Overview
ISAKMP is the negotiation protocol that lets two hosts agree on how to build an IPsec security
association (SA). It provides a common framework for agreeing on the format of SA attributes. This
security association includes negotiating with the peer about the SA and modifying or deleting the SA.
ISAKMP separates negotiation into two phases: Phase 1 and Phase 2. Phase 1 creates the first tunnel,
which protects later ISAKMP negotiation messages. Phase 2 creates the tunnel that protects data.
IKE uses ISAKMP to set up the SA for IPsec to use. IKE creates the cryptographic keys used to
authenticate peers.
The ASA supports IKEv1 for connections from the legacy Cisco VPN client, and IKEv2 for the
AnyConnect VPN client.
To set the terms of the ISAKMP negotiations, you create an IKE policy, which includes the following:
•The authentication type required of the IKEv1 peer, either RSA signature using certificates or
preshared key (PSK).
•An encryption method to protect the data and ensure privacy.
•A Hashed Message Authentication Codes (HMAC) method to ensure the identity of the sender, and
to ensure that the message has not been modified in transit.
•A Diffie-Hellman group to determine the strength of the encryption-key-determination algorithm.
The ASA uses this algorithm to derive the encryption and hash keys.
•For IKEv2, a separate pseudo-random function (PRF) used as the algorithm to derive keying
material and hashing operations required for the IKEv2 tunnel encryption and so on.
•A limit to the time the ASA uses an encryption key before replacing it.