Multiple Diffie Helfman Group In Phase 2 Cisco FMC-FTD

[qsscisco]

Hello,

Is it possible on Cisco FTD managed by Cisco FMC define multiple DH Group in Phase2 ?

From what i see it is just possible one. I tried put , but it doesnt accept. Also looking maybe for option to add thorugh flex config but didnt find any relevant docuemntation. Can anyone help?

[Rob Ingram · Accepted solution]

@qsscisco no, you can only set one DH group for PFS (phase 2), not even will FlexConfig allow you to configure two as the ASA also only supports one (Flexconfig uses the ASA commands, so if it's not supported on ASA it won't be supported on Flexconfig).

[qsscisco]

Hi Rob,

Thank you. To conclude if i have one dynamic crypto map, and have 2 remote location (one can support group21, other can support group 14 in phase 2) i cant accept establishing vpn on the same crypto map, so i need to create 2 separate dynamic crypto map, one acceptin group 21, another one accepting group 14?

Thank you

[Rob Ingram]

@qsscisco if it's two locations, just create two separate VPN topologies, either crypto map or SVTI, with different PFS DH groups.

[MHM Cisco World]

Which ver of FMC you use ?

MHM

[qsscisco]

@MHM Cisco World 

I am using 7.4.1

[MHM Cisco World]

Sorry this issue not solve ?

If yes 

Dh group you want for phaseI or phaseII

MHM

[qsscisco]

Hi,

The solution is to create new vpn topology with another DH group in phase 2. It is not possible in one VPN topology use 2 DH group in phase 2.

[MHM Cisco World]

if you see there is pencil icon beside the proposal 
add new proposal 
select it encrypt and integrity 
then I think when you click any of two proposal you will get DH group 
try this way

MHM

[Rob Ingram]

@MHM Cisco World as already stated in the previous answer, you can only select 1 PFS group.

PFS is not configured under the proposal section. You select "Enable Perfect Forward Secrecy" and select the Group from the drop down list, there is no option for multi choice.