Cisco ASA Series Cli Configuration Manual page 1803

Chapter 1 Configuring LAN-to-LAN IPsec VPNs
Step 2
Save your changes.
hostname(config)# write memory
hostname(config)#
Creating an IKEv2 Proposal
For IKEv2, you can configure multiple encryption and authentication types, and multiple integrity
algorithms for a single policy. The ASA orders the settings from the most secure to the least secure and
negotiates with the peer using that order. This allows you to potentially send a single proposal to convey
all the allowed transforms instead of the need to send each allowed combination as with IKEv1.
Table 1-1
Table 1-2
Valid Encryption Methods
des
3des (default)
aes
aes-192
aes-256
To configure an IKEv2 proposal, perform the following tasks in either single or multiple context mode:
Step 1
In global configuration mode, use the crypto ipsec ikev2 ipsec-proposal command to enter ipsec
proposal configuration mode where you can specify multiple encryption and integrity types for the
proposal. In this example, secure is the name of the proposal:
hostname(config)# crypto ipsec ikev2 ipsec-proposal secure
hostname(config-ipsec-proposal)#
Step 2
Then enter a protocol and encryption types. ESP is the only supported protocol. For example:
hostname(config-ipsec-proposal)# protocol esp encryption 3des aes des
hostname(config-ipsec-proposal)#
Step 3
Enter an integrity type. For example:
hostname(config-ipsec-proposal)# protocol esp integrity sha-1
hostname(config-ipsec-proposal)#
Step 4
Save your changes.
Configuring an ACL
The ASA uses access control lists to control network access. By default, the adaptive security appliance
denies all traffic. You need to configure an ACL that permits traffic.
lists valid IKEv2 encryption and authentication methods.
Valid IKEv2 Encryption and Integrity Methods
Valid Integrity Methods
sha (default)
md5
Cisco ASA Series CLI Configuration Guide
Creating an IKEv2 Proposal
1-7