Cisco ASA Series Cli Configuration Manual page 1753

Chapter 1 Configuring Remote Access IPsec VPNs
Command
Step 1
crypto ikev1 policy priority
authentication {crack | pre-share |
rsa-sig}
Example:
hostname(config)# crypto ikev1 policy 1
authentication pre-share
hostname(config)#
Step 2
crypto ikev1 policy priority encryption
{aes | aes-192 | aes-256 | des | 3des}
Example:
hostname(config)# crypto ikev1 policy 1
encryption 3des
hostname(config)#
Step 3
crypto ikev1 policy priority hash {md5 |
sha}
Example:
hostname(config)# crypto ikev1 policy 1
hash sha
hostname(config)#
Step 4
crypto ikev1 policy priority group
{1 | 2 | 5}
Example:
hostname(config)# crypto ikev1 policy 1
group 2
hostname(config)#
Step 5
crypto ikev1 policy priority lifetime
{seconds}
Example:
hostname(config)# crypto ikev1 policy 1
lifetime 43200
hostname(config)#
Step 6
crypto ikev1 enable interface-name
Example:
hostname(config)# crypto ikev1 enable
outside
hostname(config)#
Step 7
write memory
Example:
hostname(config-if)# write memory
Building configuration...
Cryptochecksum: 0f80bf71 1623a231 63f27ccf
8700ca6d
11679 bytes copied in 3.390 secs (3893
bytes/sec)
[OK]
hostname(config-if)#
Purpose
Specifies the authentication method and the set of parameters to
use during IKEv1 negotiation.
Priority uniquely identifies the Internet Key Exchange (IKE)
policy and assigns a priority to the policy. Use an integer from 1
to 65,534, with 1 being the highest priority and 65,534 the lowest.
In this example and the steps that follow, we set the priority to 1.
Specifies the encryption method to use within an IKE policy.
Specifies the hash algorithm for an IKE policy (also called the
HMAC variant).
Specifies the Diffie-Hellman group for the IKE policy—the
crypto protocol that allows the IPsec client and the ASA to
establish a shared secret key.
Specifies the encryption key lifetime—the number of seconds
each security association should exist before expiring.
The range for a finite lifetime is 120 to 2147483647 seconds.
Use 0 seconds for an infinite lifetime.
Enables ISAKMP on the interface named outside.
Saves the changes to the configuration.
Cisco ASA Series CLI Configuration Guide
Configuring Remote Access IPsec VPNs
1-9