HMAC support on ASA

[bruce.thornton]

How can I tell if may ASA 5525-X supports the following:

hmac-sha2-256
hmac-sha2-384
hmac-sha2-512
and if it does how do I enable it. My software ver is :

Cisco Adaptive Security Appliance Software Version 9.7(1)24

[Marvin Rhoads]

For IKEv2 you can configure the HMAC-SHA2 variants:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa913/configuration/vpn/asa-913-vpn-config/vpn-ike.html#ID-2441-000005d2

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/p3.html#pgfId-2175641

IKEv1 is limited to SHA/HMAC-160 (or MD5/HMAC-128)

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/A-H/cmdref1/c5.html#pgfId-2607523

[Cristian Matei]

Hi,

   Whatever is part of the Suite B (Next Generation Algorithms), including what you're asking for, is only supported on the ASA for IPsec tunnels build over IKEv2, so not for IPsec tunnel over IKEv1. With IKEv2 IPsec tunnels, you can use the Suite B algorithms for both the IKEv2 and IPsec tunnel (or only for one, you choose), while with IKEv1 IPsec tunnels, you can't use Suite B algorithms for IKEv1 or IPsec tunnel.

Regards,

Cristian Matei.