topic Re: HMAC support on ASA in Network Security

HMAC support on ASA

bruce.thornton — Wed, 25 Mar 2020 03:06:24 GMT

How can I tell if may ASA 5525-X supports the following:

hmac-sha2-256
hmac-sha2-384
hmac-sha2-512
and if it does how do I enable it. My software ver is :

Cisco Adaptive Security Appliance Software Version 9.7(1)24

Re: HMAC support on ASA

Marvin Rhoads — Wed, 25 Mar 2020 04:02:26 GMT

For IKEv2 you can configure the HMAC-SHA2 variants:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa913/configuration/vpn/asa-913-vpn-config/vpn-ike.html#ID-2441-000005d2

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/p3.html#pgfId-2175641

IKEv1 is limited to SHA/HMAC-160 (or MD5/HMAC-128)

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/A-H/cmdref1/c5.html#pgfId-2607523

Re: HMAC support on ASA

Cristian Matei — Wed, 25 Mar 2020 07:33:30 GMT

Hi,

Whatever is part of the Suite B (Next Generation Algorithms), including what you're asking for, is only supported on the ASA for IPsec tunnels build over IKEv2, so not for IPsec tunnel over IKEv1. With IKEv2 IPsec tunnels, you can use the Suite B algorithms for both the IKEv2 and IPsec tunnel (or only for one, you choose), while with IKEv1 IPsec tunnels, you can't use Suite B algorithms for IKEv1 or IPsec tunnel.

Regards,

Cristian Matei.