06-19-2018 03:06 AM - edited 03-12-2019 05:23 AM
My ASA firewall are running IKEV1 3DES-SHA . Can anyone guide me how to change to AES256-SHA?
Solved! Go to Solution.
06-20-2018 01:47 AM
06-19-2018 04:10 AM
Hi, You will need to create a new IKEv1 policy, make sure the policy number is lower than the current IKEv1 Policy. You will need to apply this to all firewalls, reset the tunnels and hopefully they should use the new policy.
crypto ikev1 policy 5
authentication pre-share or rsa-sig
encryption aes
hash sha
group 5
lifetime 36000
You can leave the existing IKEv1 Policy in place, no need to remove.
When the tunnel is up run the command show crypto isakmp sa to confirm the VPN is using the new algorithms.
HTH
06-19-2018 05:36 AM
Thanks for the reply. Shall I add the policy to the remote site ASA first, then local site?
is the tunnel effective immediately, or I need to run further command to turn off/on?
I saw the configuration has AES128, 192, 256. Do I need to specify which AES bits to implement?
06-19-2018 05:43 AM
06-19-2018 07:33 AM
Thanks for your reply promptly. I will try it. Do I just run the "clear crypto..." commands on local site?
If I encounter problem, shall I just disable the policy 5 and run clear crypto... commands again to fall back?
06-19-2018 07:41 AM
06-19-2018 06:02 PM - edited 06-19-2018 11:05 PM
My current crypto map is set as
crypto map myoutmap 1 ikev1 transform-set VPNESP-3DES-SHA
Do I need to create other crypto map for AES?
06-20-2018 01:47 AM
06-22-2018 08:47 PM
I will login the remote site firewall from local site throught the VPN link. If I just change the crypto map, is there any risk my session will be terminated and cannot fallback?
06-23-2018 01:19 AM
I wouldn't risk making these changes to the VPN over the VPN tunnel. I'd make sure you can access the remote VPN via SSH or ASDM on it's external interface. That way if there is an issue with the VPN tunnel and the tunnel is down you can still access the remote ASA and troubleshoot.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide