Error with Site to Site VPN (Azure and Cisco ASA)

[kamal.bernard]

Hi I have configured a site to site Vpn with Azure and my remote site uses Cisco ASA firewall.  

in my Azure the status shows as connected but in the site end it shows the below error.. 

"IKEv2 Selected IKEv2 encryption algorithm (AES-CBC-128) is not strong enough to secure proposed IPsec encryption algorithm (AES-CBC-256)."

we are not able to ping from site to azure and azure to site due to this. 

[MHM Cisco World · Accepted solution]

ASA(config)# crypto ikev2 proposal proposal-1

ASA(config-ikev2-proposal)# encryption aes-cbc-256<- if this not found then by default the AES-256 use CBC.

[kamal.bernard · Accepted solution]

Dear  MHM Cisco World

Thank you for the reply will check on this and let you know

[Rob Ingram · Accepted solution]

@kamal.bernard I would check the IKEv2 Policy, as the error would seem to indicate you've got a more secure algorithm (AES 256) configured for the IPSec proposal than you do for the IKEv2 policy (AES 128?).

Check "show run crypto ikev2" and ensure you are using AES CBC 256.

[kamal.bernard · Accepted solution]

Hi Rob 

Thank you for the reply