Cisco ASA IPSec-Proposal Limit

[rashidevron]

I am having this error message when trying to configure an IPsec-proposal on an ASA for an ikev2 IPSEC tunnel.

ERROR: ipsec policy insertion failed because the maximum proposal limit of 20 was exceeded
ERROR: Unable to insert ipsec-proposal TEST_PROPOSAL

I have been searching online through Cisco's publications, but nothing mentions a limit on ipsec-proposal.
I even checked if it was license issue on the ASA but L2L IPSec are supposed to be unlimited pending the physical resources on your ASA.
Can anyone help me with definitive answer on the limit of transform-set and ipsec-proposals? 

[Rob Ingram · Accepted solution]

@rashidevron from the ASA guides -

Configure IKEv1 and IKEv2 Policies

IKEv1 and IKEv2 each support a maximum of 20 IKE policies, each with a different set of values. Assign a unique priority to each policy that you create. The lower the priority number, the higher the priority.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/vpn/asa-922-vpn-config/vpn-ike.html

I would recommend standardising on the most secure ciphers, rather than having so many different variations.

[rashidevron]

Hello Rob,

Thanks for the info update.

I was under the impression that the policies are unlimited, however, this
makes much sense to have a set of secure predefined policies and proposals
and just apply them to your various crypto maps.

I have been configuring for years now one for each new IPSEC setup I do
with various partners. 🤦🏾‍

Thanks alot.

[rashidevron]

Hello @Rob Ingram ,

Thanks for the info update.

I was under the impression that the policies are unlimited, however, this makes much sense to have a set of secure predefined policies and proposals and just apply them to your various crypto maps.

I have been configuring for years now one for each new IPSEC setup I do with various partners. 

Thanks alot.