topic Hi Rahul,For phase 1 ISAKMP, in Network Security

ISAKMP SA showing different encryption than configured

Rahul Kumar Mishra — Tue, 12 Mar 2019 04:34:00 GMT

hi,

I have configured site to site vpn with client's firewall. We have mutually configured 3des as encryption however when I checked ISAKMP SA on my firewall it shows AES-256 as encryption...The vpn is active and the traffic is passing through the vpn.. I just wanted to know why it is showing AES-256 while 3des is configured? Both end have ASA firewall. I have software 8.6(1)2 while remote end has 8.3 (2).

Hi Rahul,For phase 1 ISAKMP,

rizwanr74 — Tue, 26 Aug 2014 17:07:38 GMT

Hi Rahul,

For phase 1 ISAKMP, these parameters exists on both devices, at the time of exchange between ASAs will pick a proposal given by an ASA, assuming AES-256 encryption is defined for the phase 1 negotiation. If you choose not to use AES-256 encryption for phase 1 negotiation, only way to force it by removing policy that contains the AES-256 encryption for phase 1.

Hope that answers your question.

Thanks

Rizwan Rafeek.