Disable Aggresive Mode

[hongsang]

I have a site-to-site VPV using IKEv1. If I would disable aggressive mode on ASA. Shall I disable at remote device or local device first, then change on the other peer? Do the VPN connection drop when apple the change? Any thing I need to be aware before make this change?

Thanks for any one can support me.

[balaji.bandi]

Tunnel will be dropped and re-established if all the setup done correctly, if this like Live environment perform in maintenance window. make sure some one available remotly in case any issue around to reset the tunnel at far end.

[hongsang]

If one firewall configure disable aggressive mode but another end not disable, what will happen?

[Deepak Kumar]

Hi,

The Firewall where you disabled the Aggressive Mode, will try with only Main Mode. And another side there where both modes are working will respond to the Main mode (Becuase he got packets in the main mode only).

Regards,

Deepak Kumar

[Rob Ingram · Accepted solution]

Cisco ASA typically use Main Mode for Site-to-Site VPNs and only use aggressive mode for Remote Access VPNs. You can determine if your current VPNs are using MM by using the command show crypto ikev1 sa

ASA-1(config-tunnel-ipsec)# show crypto ikev1 sa

IKEv1 SAs:

Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1 IKE Peer: 3.3.3.1
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE

If you see MM_ACTIVE the IKEv1 SA was established using Main Mode. Therefore you can disable aggressive mode using the command crypto ikev1 am-disable. You should be able to disable this without impacting the current tunnel, as this would only affect the establishment of an IKE SA - not the IPSec SA which data is being tunnelled.

Although obviously do take care when making the changes in a production environment, as recommended make the change in a maintenance window and ensure you have connectivity to the remote device via ssh (not through the tunnel).

HTH

[hongsang]

I checked it is MM_Active. It should be safe to disable Aggressive Mode.

Thanks for your support.