Cisco Systems IPsec Transform Sets

68-20
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter68 Configuring IKE, Load Balancing, and NAC
Configuring IPsec
•Enable IPsec pre-fragmentation—Enables or disables IPsec pre-fragmentation. The ASA
fragments tunneled packets that exceed the MTU setting before encapsulating them. If the DF bit on
these packets is set, the ASA clears the DF bit, fragments the packets, and then encapsulates them.
This action creates two independent, non-fragmented IP packets leaving the public interface and
successfully transmits these packets to the peer site by turning the fragments into complete packets
to be reassembled at the peer site.
•DF Bit Setting Policy—Choose the do-not-fragment bit policy: Copy, Clear, or Set.
Modes
The following table shows the modes in which this feature is available:
IPsec Transform Sets
Use this pane to view and add or edit transform sets. A transform is a set of operations done on a data
flow to provide data authentication, data confidentiality, and data compression. For example, one
transform is the ESP protocol with 3DES encryption and the HMAC-MD5 authentication algorithm
(ESP-3DES-MD5).
Fields
•IKEv1 IPsec Proposals (Transform Sets)—Shows the configured transform sets.
– Name—Shows the name of the transform sets.
– Mode—Shows the mode, Tunnel, of the transform set. This parameter specifies the mode for
applying ESP encryption and authentication; in other words, what part of the original IP packet
has ESP applied. Tunnel mode applies ESP encryption and authentication to the entire original
IP packet (IP header and data), thus hiding the ultimate source and destination addresses.
– ESP Encryption—Shows the Encapsulating Security Protocol (ESP) encryption algorithms for
the transform sets. ESP provides data privacy services, optional data authentication, and
anti-replay services. ESP encapsulates the data being protected.
– ESP Authentication—Shows the ESP authentication algorithms for the transform sets.
•Add—Opens the Add Transform Set dialog box, in which you can add a new transform set.
•Edit—Opens the Edit Transform Set dialog box, in which you can modify an existing transform set.
•Delete—Removes the selected transform set. There is no confirmation or undo.
•IKEv2 IPsec Proposals—Shows the configured transform sets.
– Name—Shows the name of the IKEv2 IPsec Proposal.
– Encryption—Shows the Encapsulating Security Protocol (ESP) encryption algorithms for the
IKEv2 IPsec Proposal. ESP provides data privacy services, optional data authentication, and
anti-replay services. ESP encapsulates the data being protected.
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
•—•——