0

When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are 1, 2, 5, and 7. Also, reading the official Security for VPNs with IPsec Configuration Guide, it says DH groups 1, 2, and 5 are no longer recommended and to go for group 14 or higher. So my question is: what group is to be configured on the router end so there is no issue with the tunnel?

Improve this question

1 Answer 1

Reset to default
2

You should pick the highest group number that both devices have in common. The strength of the key doesn't matter if both ends of the tunnel can't use it.

Improve this answer
1
  • Newer versions of ASA also support more modern DH groups via IKEv2 configuration. Updating the ASA is recommended, if possible.
    – FrameHowitzer
    Jun 8 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.