With the rapid evolution of networking technologies, securing communications has become paramount. In this blog, we will explore how to configure Internet Key Exchange (IKE) and IPSec on Cisco ASA firewalls, particularly focusing on changes introduced after version 9.7. These updates enhance the configuration process, making it more intuitive and robust while maintaining the high level of security expected from enterprise-grade devices.
## Understanding IKE and IPSec
**IKE** is a hybrid protocol that facilitates the establishment of security associations (SAs) and authenticated keys necessary for securing data transmissions. It operates in two main phases:
1. **IKE Phase 1**: Establishes a secure, authenticated channel between peers (ISAKMP SA).
2. **IKE Phase 2**: Negotiates SAs for IPSec, providing keying material through a process known as Quick Mode.
## Key Features of ASA Post-9.7
Cisco ASA devices running software versions 9.7 and above have introduced several enhancements to the configuration of IKE and IPSec. These include:
- **Simplified Configuration Syntax**: Cisco has streamlined commands to make configuration easier and more logical.
- **Enhanced Security Options**: Additional algorithms and methods have been included to improve security.
- **Better Integration with External Systems**: Improved PKI integration for better certificate management.
## Configuring IKE on ASA
The configuration process for IKE on ASA is broken down into two methods: using Pre-Shared Keys (PSK) and using Public Key Infrastructure (PKI). Let’s take a closer look at both methods.
### I. Using Pre-Shared Keys (PSK)
1. **Define ISAKMP Policies**: This step involves creating a policy that dictates the parameters for IKE Phase 1.
crypto ikev2 policy 10
encryption aes-256
integrity sha256
group 14
lifetime 86400
In this example:
- **Encryption**: We specify the encryption method (AES-256).
- **Integrity**: SHA-256 is chosen for integrity checks.
- **Group**: We select a Diffie-Hellman group for key exchange.
- **Lifetime**: Specifies how long the SA will be valid.
2. **Configure the Pre-Shared Key**:
tunnel-group <peer-ip> type ipsec-l2l
tunnel-group <peer-ip> ipsec-attributes
pre-shared-key <your-pre-shared-key>
Replace `<peer-ip>` with the IP address of the remote peer and `<your-pre-shared-key>` with the actual key.
### II. Using Public Key Infrastructure (PKI)
1. **Generate an RSA Key Pair**:
crypto key generate rsa usage-keys label <key-label> modulus 2048
Replace `<key-label>` with a label for the key.
2. **Enroll with a Certificate Authority (CA)**:
Configure the ASA to request a certificate from a CA:
crypto ca trustpoint <trustpoint-name>
enrollment url http://<CA-url>
subject-name CN=<your-common-name>
3. **Configure ISAKMP Policy**:
Similar to PSK but specify `rsa-sig` for authentication:
crypto ikev2 policy 20
encryption aes-256
integrity sha256
group 14
lifetime 86400
4. **Bind the Certificate to the Tunnel Group**:
tunnel-group <peer-ip> type ipsec-l2l
tunnel-group <peer-ip> ipsec-attributes
ikev2 certificate <key-label>
## Configuring IPSec (IKE Phase 2)
Once the IKE Phase 1 configuration is in place, the next step is to configure IPSec, which involves creating interesting traffic ACLs, defining transform sets, and binding these elements together in a crypto map.
1. **Create an Extended ACL**:
This ACL defines the traffic that will be encrypted.
access-list <acl-name> extended permit ip <source-ip> <source-wildcard> <destination-ip> <destination-wildcard>
2. **Create IPSec Transform Set**:
This set specifies how the IPSec tunnel will encrypt and authenticate data.
crypto ipsec ikev1 transform-set <transform-set-name> esp-aes-256 esp-sha-hmac
3. **Create a Crypto Map**:
The crypto map binds the policy together:
crypto map <map-name> 10 ipsec-isakmp
set peer <peer-ip>
set transform-set <transform-set-name>
match address <acl-name>
4. **Apply the Crypto Map to an Interface**:
Finally, apply the crypto map to the egress interface to enable IPSec.
interface <interface-name>
crypto map <map-name>
## Conclusion
With the enhancements introduced in ASA software versions 9.7 and later, configuring IKE and IPSec has become more efficient and secure. Whether using PSK or PKI, the streamlined processes allow for quick setups and robust security configurations.
For network administrators, adopting these updated methods not only enhances security posture but also ensures compatibility with modern networking standards. Always refer to Cisco’s latest documentation for updates and best practices as technologies continue to evolve.
