ikev1 Transform set issue

[av]

Hi

Anyone who can explain to me while below section 1 fails whereas section 2 goes through without any issues? The error I get is: (ERROR) Sent (Wed Oct 24 12:18:45 CEST 2018): crypto ipsec ikev1 transform-set aes_sha2 esp-aes-256 esp-sha256-hmac Received (Wed Oct 24 12:18:46 CEST 2018): crypto ipsec ikev1 transform-set aes_sha2 esp-aes-256 esp-sha256-hmac
^
ERROR: % Invalid input detected at '^' marker. 

Cisco ASA 5516x

Failing:

crypto ipsec ikev1 transform-set aes_sha esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set aes_md5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set aes_sha2 esp-aes-256 esp-sha256-hmac
crypto ipsec ikev1 transform-set 3des_md5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set 3des_sha esp-3des esp-sha-hmac

Success:

crypto ipsec ikev1 transform-set aes_sha esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set aes_md5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set 3des_md5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set 3des_sha esp-3des esp-sha-hmac

[Rob Ingram · Accepted solution]

Hi,
SHA2 is not supported when using IKEv1 on the ASA. You'd need to use IKEv2 in order to use the latest/strongest algorithms.

HTH

[av]

That explains it. Thanks.