Cisco ASA Series User Manual

1-28
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring IPsec and ISAKMP
Configuring IPsec
Detailed Steps
Step 1 Choose the Suite B ECDSA algorithm when generating a keypair:
crypto key generate [rsa [general-keys | label <name> | modules [512 | 768 | 1024 | 2048 |
4096 ] | noconfirm | usage-keys] | ecdsa [label <name> | elliptic-curve [256 | 384 | 521]
| noconfirm] ]
Step 2 Choose the Suite B ECDSA algorithem when zeroizing a keypair:
crypto key zeroize [rsa | ecdsa] [default | label <name> | noconfirm]
Configuring the Pool of Cryptographic Cores
You can change the allocation of the cryptographic cores on Symmetric Multi-Processing (SMP)
platforms to give you better throughput performance for AnyConnect TLS/DTLS traffic. These changes
can accelerate the SSL VPN datapath and provide customer-visible performance gains in AnyConnect,
smart tunnels, and port forwarding. To configure the pool of cryptographic cores, perform the following
steps.
Limitations
• Cryptographic core rebalancing is available on the following platforms:
– 5585
– 5580
– 5545/5555
– ASA-SM
• The large modulus operation is only available for 5510, 5520, 5540, and 5550 platforms.
Detailed Steps
Step 1 Configure the pool of cryptographic cores specifying one of three mutually exclusive options:
• balanced—Equally distributes cryptography hardware resources (Admin/SSL and IPsec cores).
• ipsec—Allocates cryptography hardware resources to favor IPsec (includes SRTP encrypted voice
traffic).
• ssl—Allocates cryptography hardware resources to favor Admin/SSL.
asa1(config)# crypto engine ?
configure mode commands/options:
accelerator-bias
Specify how to allocate crypto accelerator processors
asa1(config)# crypto engine accelerator-bias ?
configure mode commands/options
balanced - Equally distribute crypto hardware resources
ipsec - Allocate crypto hardware resources to favor IPsec/Encrypted Voice (SRTP)
ssl - Allocate crypto hardware resources to favor SSL
asa1(config)# crypto engine accelerator-bias ssl

Cisco ASA Series Specifications

General

Model	ASA 5505
Interfaces	Varies by model (Fast Ethernet, Gigabit Ethernet, 10 Gigabit Ethernet, etc.)
High Availability	Active/Standby or Active/Active (varies by model)
Power Supply	Varies by model
Form Factor	Varies by model
Operating System	Cisco ASA Software
IPsec VPN	Supported
SSL VPN	Supported
IPS Throughput	Varies by model