IPSec Tunnel & DH Group Settings

[markwitt]

I have created a VPN IPSec Tunnel between my Cisco ASA5515 and an Ubiquity Edge Router Lite. I am passing three different subnets. Everything is working great except when I changed the DH Group to 21 I no longer can have access to all three subnets.

If configure for 5 I get all three, configured for 19 I get two and configured for 21 I only can access one.

Is there something I have missed? Does this make any sense?

Thanks,

Mark

[balaji.bandi]

This looks odd the way you mentioned, when the VPN establish, it should have all the communication between peer allowed interesting traffic, not for 1 subnet or so on.

can you post relevant config to understand better?

[Georg Pauwen]

Hello,

which encryption/authentication algorithms are you using ? The general guideline is:

Diffie-Hellman groups 5, 14, 19, 20 --> use encryption or authentication algorithms with a 128-bit key

Diffie-Hellman group 21 or 24--> use encryption or authentication algorithms with a 256-bit key or higher

That said, group 5 should be avoided as it is no longer considered secure.