In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!
Solved
Cisco 2821 and 1841 encr aes 256
Posted on 2013-01-05
Hi,
Righ now, I have 3 sites connected using cisco hardware (837, 1841 and 2821).All of them using ipsed 3des tunnels like a triangle, 3 sites.
The side built using 1841 and 2821 should be changed from 3des to aes but this is the config:
This is used by all the crypto config, and then the specific config for each site
As far as I knowm this entry must be changed to "encr aes 256", but If I do this, 3des sites does not work.
Any idea?
regards
Righ now, I have 3 sites connected using cisco hardware (837, 1841 and 2821).All of them using ipsed 3des tunnels like a triangle, 3 sites.
The side built using 1841 and 2821 should be changed from 3des to aes but this is the config:
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
lifetime 28800
This is used by all the crypto config, and then the specific config for each site
As far as I knowm this entry must be changed to "encr aes 256", but If I do this, 3des sites does not work.
Any idea?
regards
-
4
2
2
8 Comments
You can have multiple IKE policies, the number being the priority and the order that the policies are presented when devices negotiate to find a common policy.
For example, you could configure:
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 2
lifetime 28800
This will be tried first and used for the aes sites, but drop down to the next policy (the one you currently have) for the the 3des sites.
For example, you could configure:
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 2
lifetime 28800
This will be tried first and used for the aes sites, but drop down to the next policy (the one you currently have) for the the 3des sites.
Active 6 days ago
Hi,
then, I understand the following:
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 2
lifetime 28800
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
lifetime 28800
And, with this new config and making some new changes at crypto ipsec transform-set point, doesn´t it?
then, I understand the following:
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 2
lifetime 28800
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
lifetime 28800
And, with this new config and making some new changes at crypto ipsec transform-set point, doesn´t it?
If you want to use AES for phase 2 then create another transform set, for example:
crypto ipsec transform-set ESP-AES-256-SHA esp-aes 256 esp-sha-hmac
and use this in the crypto map for the AES site to site tunnels.
crypto ipsec transform-set ESP-AES-256-SHA esp-aes 256 esp-sha-hmac
and use this in the crypto map for the AES site to site tunnels.
Active 6 days ago
Hi again,
According to this text/link
http://www.cs.wustl.edu/~jain/cse567-06/ftp/encryption_perf/index.html
I´m looking for a stronger encryption algorithm than 3des and also fast and with less CPU workload.
Is this algorithm aes 128,196,256,BF? or what?
regards
According to this text/link
http://www.cs.wustl.edu/~jain/cse567-06/ftp/encryption_perf/index.html
I´m looking for a stronger encryption algorithm than 3des and also fast and with less CPU workload.
Is this algorithm aes 128,196,256,BF? or what?
regards
Depends on your usage and security needs. AES128 is a lot better than 3des, while eating less CPU than AES256. BF is also nice, but a lot less standard.
Tamas
Tamas
Active 6 days ago
Hi,
And aes128 security?
Any doc to compare aes versions? A newer docu about this ?
Regards
And aes128 security?
Any doc to compare aes versions? A newer docu about this ?
Regards
You can find 1000s of pages on comparisons of the AES variants.
AES128 is used by most financial institutions to protect their on-line presence, including PayPal, eBay, all the banks I have accounts with in Hungary and Ireland, etc.
It's your decision if that is good enough for you, or you want super-military-grade encryption, like AES512 with DH group 14.
You can always get better (if your software/hardware supports it), but you pay for it in speed.
Tamas
AES128 is used by most financial institutions to protect their on-line presence, including PayPal, eBay, all the banks I have accounts with in Hungary and Ireland, etc.
It's your decision if that is good enough for you, or you want super-military-grade encryption, like AES512 with DH group 14.
You can always get better (if your software/hardware supports it), but you pay for it in speed.
Tamas
Featured Post
In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!
Question has a verified solution.
Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.
Have a better answer? Share it in a comment.
Join & Write a Comment Already a member? Login.
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
- Networking Hardware-Other
- MultiMedia Applications
- Switches / Hubs
- Displays / Monitors
- ATEN Technology
- Hardware, Network Architecture, *Kernel-based Virtual Machine (KVM)
Fix RPC Server is unavailable Error in Exchange 2013, 2010, 2007, and 2003 Server. Different reason can such as network connectivity issue, name resolution issue, firewall, registry corruption that lead to RPC Server Unavailable error.
Internet Business Fax to Email Made Easy -
With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number.
You'll receive secure faxes in your email, f…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Suggested Courses
Course of the Month7 days, 11 hours left to enroll
585 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.