IKE policies individually per tunnel

[ANFA]

Hello
Is there a way to give each tunnel its own IKE policy?
My problem is that I have created several, because we have many VPN partners.
If I now want to select the IKE policy for the Conection Profiles in the ASDM, I always get the message "IKE police global.It is shared by all IPsec connection profile". It happens again and again that the other side has different attitudes than at the end the ASA takes. This always leads to problems with the VPN tunnel. I would like to assign exactly one policy to the tunnels.
Does anyone know how this works? This is also possible with other renowned manufacturers.

Many Thanks

[Mohammed al Baqari]

IKE phase 1 policies are common for all ASAs.

[Karsten Iwen]

The ASA already gives you the answer: All peers share the same sets of policies. And as long as the other side has a matching policy it should work. The only problem is that the ASA could negotiate a weaker policy that doesn't match your security-policy.

Two possible workarounds for that problem:

1. Configure the VPN as "receive only". If the other side initiates the connection, it's your ASA that chooses the policy based on your configured priorities.
2. Move all VPNs with old/legacy crypto to a dedicated/different VPN-Gateway and remove the weaker policies from your main VPN-Gateway.

[ANFA]

Both solutions are not possible.
On the one hand, both sides must be able to build up the tunnel.
on the other hand, we often have different lifetime to different VPN partners. Here is often also the biggest problem that the ASA thinks a policy with other lift time takes even though the counterpart has set a completely different.

Is there no other possibility? For VPN Gateway from other manufacturers, I know that you can do everything per tunnel according to the settings.

[Karsten Iwen]

Lifetimes are used as the smallest value of the matching policies in IKEv1. They don't have to be the same on both ends. And there shouldn't arise a problem of that; at least not a technical one.

I do not think that you can accomplish this with the ASA.

[ANFA]

Unfortunately, we have often had technical problems with VPN Traffic due to different Lifetime

[Mohammed al Baqari]

Hi Karsten,

You are right when it's cisco both end. But I have seen problems with life
time when its different vendors (i faced this with juniper cisco combi)

[Karsten Iwen]

Really? When setting up VPNs to third-parties, I never care about the different lifetime and never had problems that were related to these. Very strange ...

[Mohammed al Baqari]

What about migrating to ikev2. You can achieve it with ikev2

[ANFA]

How would the procedure be with IKVv2?
There are global attitudes as well

[Mohammed al Baqari]

In IKEv2 you configure proposal with phase 1 parameters and assign it to
profile which maps the parameters to peer.