Hi Dean,
AES-CBC is an encryption algorithm, whereas SHA is a hashing algorithm, they are seperate algorithms. AES-GCM algorithm performs both encryption and hashing functions without requiring a seperate hashing algorithm, it is the latest Suite B Next Generation algorithm and probably not supported on as ASA 5505.
So on the ASA you'd define the encryption as AES-CBC 128|192|256 and then hashing as SHA 128|192|256, that should work fine with the PA firewall.
Example:-
crypto ikev1 policy 10
encryption aes-256
hash sha
crypto ipsec ikev1 transform-set VPN-TRANSFORM esp-aes-256 esp-sha-hmac
HTH
Hi Dean,
AES-CBC is an encryption algorithm, whereas SHA is a hashing algorithm, they are seperate algorithms. AES-GCM algorithm performs both encryption and hashing functions without requiring a seperate hashing algorithm, it is the latest Suite B Next Generation algorithm and probably not supported on as ASA 5505.
So on the ASA you'd define the encryption as AES-CBC 128|192|256 and then hashing as SHA 128|192|256, that should work fine with the PA firewall.
Example:-
crypto ikev1 policy 10
encryption aes-256
hash sha
crypto ipsec ikev1 transform-set VPN-TRANSFORM esp-aes-256 esp-sha-hmac
HTH
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips.
How to use Community
New member guide
Log in to Community
