Diffie-Hellman groups - ASA firewalls

[Alex Sykes]

Hi all,

A couple of questions I'm hoping you can help me with.

Please can you tell me where I'd change the Diffie-Hellman group for phase 1 on an ASA firewall and can this be done on the ASDM?

Also, do you have to enable PFS have to DH on phase 2?

Many thanks

Alex

[Dinesh Moudgil · Accepted solution]

Hello Alex,

You can change the Diffie-Hellman group for phase 1 on ASA by configuring the following command:

crypto isakmp policy

     group

To configure the same using ASDM, go to

Configuration>Site-to-Site VPN>Connection Profiles>Add/Edit

In IPsec Settings, you will find Encryption Algorithms .Click on "Manage" icon on the right  of "IKE Policy".Click OK.

Click on Add/Edit and there will be an option to change the DH Group.

And lastly in regard to the PFS query , you can enable PFS in  order to have DH in phase 2.Enabling PFS will force a new DH key  exchange for phase 2.

Note:It is not mandatory , its optional .If its configured on one side , then it needs to be done on the remote side as well.

Regards,

Dinesh Moudgil

[Alex Sykes]

Hi Dinesh,

Many thanks for your quick answer.

This is exactly what I was after.

Kind regards

Alex