64-29
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter64 Configuring IPsec and ISAKMP
Configuring IPsec
•Requires protection for all inbound traffic.
In this scenario, the ASA silently drops all inbound packets that lack IPsec protection.
Be sure that you define which packets to protect. If you use the any keyword in a permit statement,
preface it with a series of deny statements to filter out traffic that would otherwise fall within that permit
statement that you do not want to protect.
Note Decrypted through traffic is permitted from the client despite having an access group on the outside
interface, which calls a deny ip any any access-list, while no sysopt connection permit-vpn is
configured.
Users who want to control access to the protected network via site-to-site or remote access VPN using
the no sysopt permit command in conjunction with an access control list (ACL) on the outside interface
are not successful.
In this situation, when management-access inside is enabled, the ACL is not applied, and users can still
connect using SSH to the security appliance. Traffic to hosts on the inside network are blocked correctly
by the ACL, but cannot block decrypted through traffic to the inside interface.
The ssh and http commands are of a higher priority than the ACLs. In other words, to deny SSH, Telnet,
or ICMP traffic to the device from the VPN session, use ssh, telnet and icmp commands, which deny
the IP local pool should be added.
Changing IPsec SA Lifetimes
You can change the global lifetime values that the ASA uses when negotiating new IPsecSAs. You can
override these global lifetime values for a particular crypto map.
IPsec SAs use a derived, shared, secret key. The key is an integral part of the SA; the keys time out
together to require the key to refresh. Each SA has two lifetimes: timed and traffic-volume. An SA
expires after the respective lifetime and negotiations begin for a new one. The default lifetimes are
28,800 seconds (eight hours) and 4,608,000 kilobytes (10 megabytes per second for one hour).
If you change a global lifetime, the ASA drops the tunnel. It uses the new value in the negotiation of
subsequently established SAs.
When a crypto map does not have configured lifetime values and the ASA requests a new SA, it inserts
the global lifetime values used in the existing SA into the request sent to the peer. When a peer receives
a negotiation request, it uses the smaller of either the lifetime value the peer proposes or the locally
configured lifetime value as the lifetime of the new SA.
The peers negotiate a new SA before crossing the lifetime threshold of the existing SA to ensure that a
new SA is ready when the existing one expires. The peers negotiate a new SA when about 5 to 15 percent
of the lifetime of the existing SA remains.
Creating a Basic IPsec Configuration
You can create basic IPsec configurations with static or dynamic crypto maps.
To create a basic IPsec configuration using a static crypto map, perform the following steps:
Step1 To create an access list to define the traffic to protect, enter the following command: