Lan to Lan Ipsec Encryption

[bmurray]

          Is there a best practices document on lan to lan encryption configuration for phase 1 and phase 2?

Using Asa 8.2 and 9.1        

[Andrew Phirsov]

What about config guides on cisco.com for corresponding ASA OS versions? I think it's all explained there on which algorithms do what kind of performance impact/ which one faster or slower and all that in comparsion.

[Hardik Vaidh]

Dear bmurray

crypto isakmp policy 1
encr 3des

hash md5
authentication pre-share
group 2
crypto isakmp key XXX address (peer ip)  // insted of xxx write key whatever you want but make sure both side must b match

crypto ipsec transform-set 192.168.1.1 esp-3des esp-md5-hmac

[Daniel Leonard]

Maybe this post will be helpful; https://supportforums.cisco.com/message/3813984#3813984

I've asked about VPN encryption and did some research. To my way of thinking, go for IKEv2 and AES-256 encryption in both phases. Use DH-group 14 or 24, and pfs 5. I think this will be the best option available for all asa series from release 9 (when considering hardware limitations).

Please mark answered for helpful posts.

Sent from Cisco Technical Support iPhone App