Cisco ASA Series Cli Configuration Manual page 1552

Information About Tunneling, IPsec, and ISAKMP
The ASA functions as a bidirectional tunnel endpoint. It can receive plain packets from the private
network, encapsulate them, create a tunnel, and send them to the other end of the tunnel where they are
unencapsulated and sent to their final destination. It can also receive encapsulated packets from the
public network, unencapsulate them, and send them to their final destination on the private network.
IPsec Overview
The ASA uses IPsec for LAN-to-LAN VPN connections and provides the option of using IPsec for
client-to-LAN VPN connections. In IPsec terminology, a peer is a remote-access client or another secure
gateway. For both connection types, the ASA supports only Cisco peers. Because we adhere to VPN
industry standards, ASAs can work with other vendors' peers; however, we do not support them.
During tunnel establishment, the two peers negotiate security associations that govern authentication,
encryption, encapsulation, and key management. These negotiations involve two phases: first, to
establish the tunnel (the IKE SA) and second, to govern traffic within the tunnel (the IPsec SA).
A LAN-to-LAN VPN connects networks in different geographic locations. In IPsec LAN-to-LAN
connections, the ASA can function as initiator or responder. In IPsec client-to-LAN connections, the
ASA functions only as responder. Initiators propose SAs; responders accept, reject, or make
counter-proposals—all in accordance with configured SA parameters. To establish a connection, both
entities must agree on the SAs.
Configuration for site to site tasks is performed in both single context mode and multiple context mode.
Note
Multiple context mode only applies to IKEv2 and IKEv1 site to site and does not apply to AnyConnect,
clientless SSL VPN, the legacy Cisco VPN client, the Apple native VPN client, the Microsoft native
VPN client, or cTCP for IKEv1 IPsec.
ISAKMP and IKE Overview
ISAKMP is the negotiation protocol that lets two hosts agree on how to build an IPsec security
association (SA). It provides a common framework for agreeing on the format of SA attributes. This
security association includes negotiating with the peer about the SA and modifying or deleting the SA.
ISAKMP separates negotiation into two phases: Phase 1 and Phase 2. Phase 1 creates the first tunnel,
which protects later ISAKMP negotiation messages. Phase 2 creates the tunnel that protects data.
IKE uses ISAKMP to set up the SA for IPsec to use. IKE creates the cryptographic keys used to
authenticate peers.
The ASA supports IKEv1 for connections from the legacy Cisco VPN client, and IKEv2 for the
AnyConnect VPN client.
To set the terms of the ISAKMP negotiations, you create an IKE policy, which includes the following:
•
•
•
•
Cisco ASA Series CLI Configuration Guide
1-2
The authentication type required of the IKEv1 peer, either RSA signature using certificates or
preshared key (PSK).
An encryption method to protect the data and ensure privacy.
A Hashed Message Authentication Codes (HMAC) method to ensure the identity of the sender, and
to ensure that the message has not been modified in transit.
A Diffie-Hellman group to determine the strength of the encryption-key-determination algorithm.
The ASA uses this algorithm to derive the encryption and hash keys.
Chapter 1 Configuring IPsec and ISAKMP