wreedMH
Hot Shot
Hot Shot

NSX IPSEC VPN to Cisco ASA

Anyone accomplished this? Any tips/tricks?

0 Kudos
1 Reply
Sreec
VMware Employee
VMware Employee

Few points to be noted are as follows

Below mentioned are the algorithm that is supported

  • AES (AES128-CBC)
  • AES256 (AES256-CBC)
  • Triple DES (3DES192-CBC)
  • AES-GCM (AES128-GCM)
  • DH-2 (Diffie–Hellman group 2)
  • DH-5 (Diffie–Hellman group 5)
  • DH-14 (Diffie–Hellman group 14)
  • DH-15 (Diffie–Hellman group 15)
  • DH-16 (Diffie–Hellman group 16)

Phase 1 Parameters

Phase 1 sets up mutual authentication of the peers, negotiates cryptographic parameters, and creates session keys. The Phase 1 parameters used by NSX Edge are:

  • Main mode
  • TripleDES / AES [Configurable]
  • SHA-1
  • MODP group 2 (1024 bits)
  • pre-shared secret [Configurable]
  • SA lifetime of 28800 seconds (eight hours) with no kbytes rekeying
  • ISAKMP aggressive mode disabled

Phase 2 Parameters

IKE Phase 2 negotiates an IPSec tunnel by creating keying material for the IPSec tunnel to use (either by using the IKE phase one keys as a base or by performing a new key exchange). The IKE Phase 2 parameters supported by NSX Edge are:

  • TripleDES / AES [Will match the Phase 1 setting]
  • SHA-1
  • ESP tunnel mode
  • MODP group 2 (1024 bits)
  • Perfect forward secrecy for rekeying
  • SA lifetime of 3600 seconds (one hour) with no kbytes rekeying
  • Selectors for all IP protocols, all ports, between the two networks, using IPv4 subnets

Ensure that algorithm and Phase1 & Phase 2 settings are correct on both the sides.

There are few examples  mentioned in below links including CISCO ASA .

IPSec VPN Configuration Examples

Cheers,
Sree | CKA|CKAD|VCIX-3X| VCAP-4X| VExpert 5x
Please KUDO helpful posts and mark the thread as solved if answered
0 Kudos