Cisco Systems Configuring IPsec

68-11
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter68 Configuring IKE, Load Balancing, and NAC
Configuring IPsec
The IP addresses in the pool range must not be assigned to other network resources.
Fields
•Name—Assign an alpha-numeric name to the address pool. Limit 64 characters
•Starting IP Address—Enter the first IP address available in this pool. Use dotted decimal notation,
for example: 10.10.147.100.
•Ending IP Address—Enter the last IP address available in this pool. Use dotted decimal notation,
for example: 10.10.147.100.
•Subnet Mask—Choose the subnet mask for the IP address pool.
Modes
The following table shows the modes in which this feature is available:
Configuring IPsec
The ASA uses IPsec for LAN-to-LAN VPN connections, and provides the option of using IPsec for
client-to-LAN VPN connections. In IPsec terminology, a “peer” is a remote-access client or another
secure gateway.
Note The ASA supports LAN-to-LAN IPsec connections with Cisco peers (IPv4 or IPv6), and with third-party
peers that comply with all relevant standards.
During tunnel establishment, the two peers negotiate security associations that govern authentication,
encryption, encapsulation, and key management. These negotiations involve two phases: first, to
establish the tunnel (the IKE SA); and second, to govern traffic within the tunnel (the IPsec SA).
A LAN-to-LAN VPN connects networks in different geographic locations. In IPsec LAN-to-LAN
connections, the ASA can function as initiator or responder. In IPsec client-to-LAN connections, the
ASA functions only as responder. Initiators propose SAs; responders accept, reject, or make
counter-proposals—all in accordance with configured SA parameters. To establish a connection, both
entities must agree on the SAs.
The ASA supports these IPsec attributes:
•Main mode for negotiating phase one ISAKMP security associations when using digital certificates
for authentication
•Aggressive mode for negotiating phase one ISAKMP Security Associations (SAs) when using
preshared keys for authentication
•Authentication Algorithms:
– ESP-MD5-HMAC-128
– ESP-SHA1-HMAC-160
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
•—•——