ASA 55XX shav2, DH group 5

[s-ito65535]

Hi All,

The asa55xx is running that "shav1 and DH group 2 setting" for site-to-site VPN.

We want change the setting to "shav2 and DH group 5".

Can we change to above the setting on the asa55xx ??

Kindly,

[johnlloyd_13 · Accepted solution]

hi,

yes, you can achieve it using IKE version 2.

see helpful link and config snippet below:

http://ccnpsecuritywannabe.blogspot.com/2014/08/ikev2-ipsec-site-to-site-vpns.html

ASA1(config-ikev2-policy)# integrity ?

ikev2-policy mode commands/options:
  md5     set hash md5
  sha     set hash sha1
  sha256  set hash sha256
  sha384  set hash sha384
  sha512  set hash sha512
ASA1(config-ikev2-policy)# integrity sha256
ASA1(config-ikev2-policy)# group ?

ikev2-policy mode commands/options:
  1  Diffie-Hellman group 1
  2  Diffie-Hellman group 2
  5  Diffie-Hellman group 5

[s-ito65535]

Hi johnlloyd_13,

Thank you for your great support.

I will try the "integrity setting".

Kindly,