S2S IPSec VPN on ASA5505: Which IOS Image Does Support SHA-2

[fntowo2009]

Hello,

Could someone tell me the IOS image I need to support SHA-2 on an ASA5505?

Below is some relevant info.

Thanks in advance for your input!

---- My ASA5505

Cisco Adaptive Security Appliance Software Version 9.1(7)4 

Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz,

ASA(config-ipsec-proposal)# protocol esp integrity ?

ipsec-proposal mode commands/options:

  md5    set hash md5

  null   set hash null

  sha-1  set hash sha-1

===  Available Images

https://software.cisco.com/download/home/280582808/type/280775065/release

[Rob Ingram]

@fntowo2009 well this Cisco ASA 9.1 guide implies IKEv2 will work on the 5505.

Did you specify IKEV2 when creating that IPSec proposal, the output you provided is not clear.

ASA(config)# crypto ipsec ikev2 ipsec-proposal TSET
ASA(config-ipsec-proposal)# protocol esp encryption aes-256

[fntowo2009]

Rob,

Thanks for the prompt feedback!

Below is the requested info.

====

ASA(config)# crypto ipsec ikev2 ipsec-proposal test

ASA(config-ipsec-proposal)# protocol esp integrity ?

ipsec-proposal mode commands/options:

  md5    set hash md5

  null   set hash null

  sha-1  set hash sha-1

ASA(config-ipsec-proposal)# protocol esp integrity 

[Rob Ingram · Accepted solution]

@fntowo2009 ok, looks like you cannot use SHA2 on the older ASA models.

"SHA-256 can be used for integrity and PRF to establish IKEv2 tunnels, but it can also be used for ESP integrity protection on the newer ASA platforms (and not 5505, 5510, 5520, 5540, or 5550)."

https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/vpn/asa_91_vpn_config/vpn_ike.html

[fntowo2009]

Much appreciated. 

[MHM Cisco World · Accepted solution]

ASA support for SHA-2 for crypto IPsec and PKI operations part 2
CSCuj67576

[fntowo2009]

9.4 isn't an option for ASA5505.