Cisco ASA 5508 and SHA-512 on IKEv1?

[testag]

Hi,

we are facing the issue, that one one End there is the Cisco ASA 5508 and on the other a Sophos UTM 9.6x We need to establish a site 2 site VPN Ipsec connection. I am on the end with the Sophos. Sophos defintely is not capable of Ikev2, as the Cisco is. BUT: I can configure an Ipsec Host connection, whre I am able to chose SHA-512 as IKE authentication algorithm and as IPsec authentication algorithm. On the other end the person is telling me, that he can only select sha-1 when editing the Ike policy.

So we are in a dead end here? I really don't want to use sha-1 and cannot belief, that the Cisco capabilities are limited to sha-1.

Any ideas?

[Rob Ingram]

@testag

If the ASA is using IKEv1, then only MD5 or SHA-1 hashing algorithm is supported. If using IKEv2, then yes the ASA supports the latest NGE algorithms - SHA-256, 384 and 512 etc.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/asdm714/vpn/asdm-714-vpn-config/vpn-asdm-ike.html

I'm not familar with Sophos, but this guide says IKEv2 is supported - will it not work on your Sophos UTM hardware?

https://support.sophos.com/support/s/article/KB-000036987?language=en_US

If you cannot upgrade the Sophos for whatever reason to support IKEv2, then you've no real alternative then to use IKEv1 with SHA-1?

[Marvin Rhoads]

Like, @Rob Ingram said. Here's a quote from the United States National Security Agency (NSA) public guidelines for configuring IPsec VPNs:

For Cisco ASA devices, NSA recommends IKEv2, since the IKEv1 implementation only supports SHA1.

IKEv2:
crypto ikev2 policy 1
encryption [aes-256|aes-gcm-256]
integrity [sha384|sha512]
group [16|20]
IPsec:
crypto ipsec ikev2 ipsec-proposal <proposal name>
protocol esp encryption [aes-256|aes-gcm-256]
protocol esp integrity [sha-384|sha512]

[Damura]

Hi Marvin

With a Cisco ASA5508-K9 device, is it possible to use IKEv2 with those parameters?

[Marvin Rhoads]

Yes. All ASA versions 8.4 or later support IKEv2 with a base license.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/crypto-a-to-crypto-ir-commands.html#wp3628010940

AES-256 encryption requires the 3DES-AES license.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/intro-license.html#concept_B138A3A0AFF54802A3471E614055D1A7

[MHM Cisco World]

Asa support ikev2 but are Sophos support it ?

https://community.sophos.com/utm-firewall/f/general-discussion/120674/ikev2

This link say no. 

But make double check.