63-11
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Chapter 63 Configuring IKE, Load Balancing, and NAC
Configuring IPsec
–
Service—Specifies the service and protocol specified by the rule (TCP, UDP, ICMP, or IP).
–
Action—Specifies the type of IPsec rule (protect or do not protect).
• Transform Set—Displays the transform set for the rule.
• Peer—Identifies the IPsec peer.
• PFS—Displays perfect forward secrecy settings for the rule.
• NAT-T Enabled—Indicates whether NAT Traversal is enabled for the policy.
• Reverse Route Enabled—Indicates whether Reverse Route Injection is enabled for the policy.
• Connection Type—(Meaningful only for static tunnel policies.) Identifies the connection type for
this policy as bidirectional, originate-only, or answer-only).
• SA Lifetime—Displays the SA lifetime for the rule.
• CA Certificate—Displays the CA certificate for the policy. This applies to static connections only.
• IKE Negotiation Mode—Displays whether IKE negotiations use main or aggressive mode.
• Description—(Optional) Specifies a brief description for this rule. For an existing rule, this is the
description you typed when you added the rule. An implicit rule includes the following description:
“Implicit rule.” To edit the description of any but an implicit rule, right-click this column, and
choose Edit Description or double-click the column.
• Enable Anti-replay window size—Sets the anti-replay window size, between 64 and 1028 in
multiples of 64. One side-effect of priority queueing in a hierarchical QoS policy with traffic
shaping (see the “Rule Actions > QoS Tab”) is packet re-ordering. For IPsec packets, out-of-order
packets that are not within the anti-replay window generate warning syslog messages. These
warnings becomes false alarms in the case of priority queueing. Configuring the anti-replay pane
size helps you avoid possible false alarms.
Modes
The following table shows the modes in which this feature is available:
Creating an IPsec Rule/Tunnel Policy (Crypto Map) - Basic Tab
Use this pane to define a new Tunnel Policy for an IPsec rule. The values you define here appear in the
IPsec Rules table after you click OK. All rules are enabled by default as soon as they appear in the IPsec
Rules table.
The Tunnel Policy pane lets you define a tunnel policy that is used to negotiate an IPsec (Phase 2)
security association (SA). ASDM captures your configuration edits, but does not save them to the
running configuration until you click Apply.
Every tunnel policy must specify a transform set and identify the security appliance interface to which
it applies. The transform set identifies the encryption and hash algorithms that perform IPsec encryption
and decryption operations. Because not every IPsec peer supports the same algorithms, you might want
to specify a number of policies and assign a priority to each. The security appliance then negotiates with
the remote IPsec peer to agree on a transform set that both peers support.
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
• — • ——
To Next Page
Loading...
Need help?
General
