Cisco Systems ASA5515K9, ASA 5500 Creating IKE Policies to Respond to Windows 7 Proposals

65-16
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter65 Configuring L2TP over IPsec
Configuring L2TP over IPsec
Creating IKE Policies to Respond to Windows 7 Proposals
Windows 7 L2TP/IPsec clients send several IKE policy proposals to establish a VPN connection with
the ASA. Define one of the following IKE policies to facilitate connections from Windows 7 VPN native
clients.
Command Purpose
Step1 Detailed CLI Configuration Steps, page 65-13 Follow the Detailed CLI Configuration
Steps procedure through step Step18. Add
the additional steps in this table to configure
the IKE policy for Windows 7 native VPN
clients.
Step1 show run crypto ikev1
Example:
hostname(config)# show run crypto ikev1
Displays the attributes and the number of
any existing IKE policies.
Step2 crypto ikev1 policy number
Example:
hostname(config)# crypto ikev1 policy number
hostname(config-ikev1-policy)#
Allows you to configure an IKE policy. The
number argument specifies the number of
the IKE policy you are configuring. This
number was listed in the output of the show
run crypto ikev1 command.
Step3 authentication
Example:
hostname(config-ikev1-policy)# authentication pre-share
Sets the authentication method the ASA
uses to establish the identity of each IPsec
peer to use preshared keys.
Step4 encryption type
Example:
hostname(config-ikev1-policy)# encryption
{3des|aes|aes-256}
Choose a symmetric encryption method that
protects data transmitted between two IPsec
peers. For Windows 7 choose either 3des,
aes, for 128-bit AES, or aes-256.
Step5 hash
Example:
hostname(config-ikev1-policy)# hash sha
Choose the hash algorithm that ensures data
integrity. For Windows 7, specify sha for the
SHA-1 algorithm.
Step6 group
Example:
hostname(config-ikev1-policy)# group 5
Choose the Diffie-Hellman group identifier.
You can specify 5 for aes, aes-256, or 3des
encryption types. You can specify 2 only for
3des encryption types.
Step7 lifetime
Example:
hostname(config-ikev1-policy)# lifetime 86400
Specify the SA lifetime in seconds. For
Windows 7, specify 86400 seconds to
represent 24 hours.