Filter
Top Products
34-11
Cisco ASDM User Guide
OL-16647-01
Chapter 34 IKE
IPsec
• SA Lifetime—Displays the SA lifetime for the rule.
• CA Certificate—Displays the CA certificate for the policy. This applies to static connections only.
• IKE Negotiation Mode—Displays whether IKE negotiations use main or aggressive mode.
• Description—(Optional) Specifies a brief description for this rule. For an existing rule, this is the
description you typed when you added the rule. An implicit rule includes the following description:
“Implicit rule.” To edit the description of any but an implicit rule, right-click this column, and
choose Edit Description or double-click the column.
• Enable Anti-replay window size—Sets the anti-replay window size, between 64 and 1028 in
multiples of 64. One side-effect of priority queueing in a hierarchical QoS policy with traffic
shaping (see the “Rule Actions > QoS Tab” section on page 21-26) is packet re-ordering. For IPsec
packets, out-of-order packets that are not within the anti-replay window generate warning syslog
messages. These warnings becomes false alarms in the case of priority queueing. Configuring the
anti-replay window size helps you avoid possible false alarms.
Modes
The following table shows the modes in which this feature is available:
Create IPsec Rule/Tunnel Policy (Crypto Map) - Basic Tab
Use this pane to define a new Tunnel Policy for an IPsec rule. The values you define here appear in the
IPsec Rules table after you click OK. All rules are enabled by default as soon as they appear in the IPsec
Rules table.
The Tunnel Policy panel lets you define a tunnel policy that is used to negotiate an IPsec (Phase 2)
security association (SA). ASDM captures your configuration edits, but does not save them to the
running configuration until you click Apply.
Every tunnel policy must specify a transform set and identify the security appliance interface to which
it applies. The transform set identifies the encryption and hash algorithms that perform IPsec encryption
and decryption operations. Because not every IPsec peer supports the same algorithms, you might want
to specify a number of policies and assign a priority to each. The security appliance then negotiates with
the remote IPsec peer to agree on a transform set that both peers support.
Tunnel policies can be static or dynamic. A static tunnel policy identifies one or more remote IPsec peers
or subnetworks to which your security appliance permits IPsec connections. A static policy can be used
whether your security appliance initiates the connection or receives a connection request from a remote
host. A static policy requires you to enter the information necessary to identify permitted hosts or
networks.
A dynamic tunnel policy is used when you cannot or do not want to provide information about remote
hosts that are permitted to initiate a connection with the security appliance. If you are only using your
security appliance as a VPN client in relation to a remote VPN central-site device, you do not need to
configure any dynamic tunnel policies. Dynamic tunnel policies are most useful for allowing remote
access clients to initiate a connection to your network through a security appliance acting as the VPN
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
• — • ——