07-10-2020 06:06 AM
I have created a VPN IPSec Tunnel between my Cisco ASA5515 and an Ubiquity Edge Router Lite. I am passing three different subnets. Everything is working great except when I changed the DH Group to 21 I no longer can have access to all three subnets.
If configure for 5 I get all three, configured for 19 I get two and configured for 21 I only can access one.
Is there something I have missed? Does this make any sense?
Thanks,
Mark
07-10-2020 07:14 PM
This looks odd the way you mentioned, when the VPN establish, it should have all the communication between peer allowed interesting traffic, not for 1 subnet or so on.
can you post relevant config to understand better?
07-10-2020 11:54 PM
Hello,
which encryption/authentication algorithms are you using ? The general guideline is:
Diffie-Hellman groups 5, 14, 19, 20 --> use encryption or authentication algorithms with a 128-bit key
Diffie-Hellman group 21 or 24--> use encryption or authentication algorithms with a 256-bit key or higher
That said, group 5 should be avoided as it is no longer considered secure.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide