Selection of DH group in IPsec VPN

[VIrendraMourya6156]

Dear Members,

i am looking for an answer to this query, if someone could help me.

We have an IPsec S-2-S vpn setup between two Firewall, at one end it is Cisco Firepower(5555-x) where as other end its Cisco ASA 5515.

We are running ikev2. Ikev2 policy is created where multiple DH values are used in the policy (DH 14,21,24 etc) and similar config present in the remote end. 

I would like to know how does the firewall decides which group to use for key exchange, is there any rule ? Please assist.

[Sheraz.Salim · Accepted solution]

in Ikev2 the values of DH 14,21,24 will go in a sequence for example 14 will check first if not match than go for 21 and so on.

https://tools.ietf.org/html/rfc5996#appendix-B

initiator sends its Diffie-Hellman value in the IKE_SA_INIT, it must guess the Diffie-Hellman group that the responder will select from its list of supported groups. If the initiator guesses wrong, the responder will respond with a Notify
payload of type INVALID_KE_PAYLOAD indicating theselected group. In this case, the initiator MUST retry the IKE_SA_INIT with the corrected Diffie-Hellman group. The initiator MUST again propose its
full set of acceptable cryptographic suites becase the rejection message was unauthenticated and otherwise an active attacker couldtrick the endpoints into negotiating a weaker suite than a stronger one that they both prefer.

[VIrendraMourya6156]

Thank You.