Cisco ASA Series User Manual

1-10
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring IPsec and ISAKMP
Configuring ISAKMP
sha256 SHA 2, 256-bit digest Specifies the Secure Hash Algorithm SHA 2 with the
256-bit digest.
sha384 SHA 2, 384-bit digest Specifies the Secure Hash Algorithm SHA 2 with the
384-bit digest.
sha512 SHA 2, 512-bit digest Specifies the Secure Hash Algorithm SHA 2 with the
512-bit digest.
null When AES-GCM is specified as the encryption algorithm,
an administrator can choose null as the IKEv2 integrity
algorithm.
encryption des
3des (default)
56-bit DES-CBC
168-bit Triple DES
Specifies the symmetric encryption algorithm that protects
data transmitted between two IPsec peers. The default is
168-bit Triple DES.
aes
aes-192
aes-256
The Advanced Encryption Standard supports key lengths of
128, 192, 256 bits.
aes-gcm
aes-gcm-192
aes-gcm-256
null
AES-GCM algorithm
options to use for IKEv2
encryption
The Advanced Encryption Standard supports key lengths of
128, 192, 256 bits.
policy_index Accesses the IKEv2 policy sub-mode.
prf sha (default) SHA-1 (HMAC variant) Specifies the pseudo random function (PRF)—the
algorithm used to generate keying material.
md5 MD5 (HMAC variant) The default is SHA-1. MD5 has a smaller digest and is
considered to be slightly faster than SHA-1. A successful
(but extremely difficult) attack against MD5 has occurred;
however, the HMAC variant IKE uses prevents this attack.
sha256 SHA 2, 256-bit digest Specifies the Secure Hash Algorithm SHA 2 with the
256-bit digest.
sha384 SHA 2, 384-bit digest Specifies the Secure Hash Algorithm SHA 2 with the
384-bit digest.
sha512 SHA 2, 512-bit digest Specifies the Secure Hash Algorithm SHA 2 with the
512-bit digest.
priority Extends the policy mode to support the additional IPsec V3
features and makes the AES-GCM and ECDH settings part
of the Suite B support.
Table 1-2 IKEv2 Policy Keywords for CLI Commands (continued)
Command Keyword Meaning Description

Cisco ASA Series Specifications

General

Model	ASA 5505
Interfaces	Varies by model (Fast Ethernet, Gigabit Ethernet, 10 Gigabit Ethernet, etc.)
High Availability	Active/Standby or Active/Active (varies by model)
Power Supply	Varies by model
Form Factor	Varies by model
Operating System	Cisco ASA Software
IPsec VPN	Supported
SSL VPN	Supported
IPS Throughput	Varies by model