Site to Site VPN with IKEV2 allows authentication through PSK at both side ?

[subrun.jamil]

Hello All,

Looking at below link for Site to Site VPN with IKev2 , Cisco is saying for IKEv2 they allow asymmetric authentication like one side psk and other remote side certification authentication but still it also allows both side authentication with psk right ?  

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113486-ikev2-s2s-tunnel-00.html

Quote from above link

""The major difference between IKE versions 1 and 2 lies in terms of the authentication method they allow. IKEv1 allows only one type of authentication at both VPN ends (that is, either pre-shared key or certificate). However, IKEv2 allows asymmetric authentication methods to be configured (that is, pre-shared-key authentication for the originator, but certificate authentication for the responder) using separate local and remote authentication CLIs.

Further, you can have different pre-shared keys at both ends. The Local Pre-shared key at the HQ-ASA end becomes the Remote Pre-shared key at the BQ-ASA end. Likewise, the Remote Pre-shared key at the HQ-ASA end becomes the Local Pre-shared key at the BQ-ASA end. ""

[Rob Ingram · Accepted solution]

Hi,
Yes, with IKEv2 you can have both sides authenticate using PSK
Yes, you can have the local PSK at the HQ become the remote PSK at the BQ and vice versa.
HTH

[subrun.jamil]

Thank RJI

[Florin Barhala]

I don't want to really start a new topic.
Can anyone reference me to a ASA document that explains the differences between different AES-256 encryption methods:

ipsec-proposal mode commands/options:
aes-256 aes-256 encryption
aes-gcm-256 aes-gcm-256 encryption
aes-gmac-256 aes-gmac-256 encryption

Thanks!

[Rob Ingram]

I use this Cisco doc for a list of recommended encryption algorithms.

aes-256 is the acceptable current standard

aes-gcm is NGE (next generation encryption). It also provides integrity, so no need to use hashing algorithm (SHA etc) as well.

There is no mention of aes-gmac in the above link, but according to the rfc GMAC only

provide data origin authentication, but not confidentiality

I've not come across aes-gmac before, not sure if it's widely used. Seems like Cisco (as per referenced link) recommend AES-GCM as their NGE algorithm.

HTH

[Florin Barhala]

Thank you very much, RJI !