When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are 1, 2, 5, and 7. Also, reading the official Security for VPNs with IPsec Configuration Guide, it says DH groups 1, 2, and 5 are no longer recommended and to go for group 14 or higher. So my question is: what group is to be configured on the router end so there is no issue with the tunnel?

1 Answer 1


You should pick the highest group number that both devices have in common. The strength of the key doesn't matter if both ends of the tunnel can't use it.

  • Newer versions of ASA also support more modern DH groups via IKEv2 configuration. Updating the ASA is recommended, if possible. Jun 8, 2023 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.