• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2807
  • Last Modified:

Enforce encryption strength on Cisco ASA VPN

Hello

My client has an ASA 5505 firewall using the classic VPN client software. Cisco are dropping support for this client so we want to move to Anyconnect Essentials client software and we will upgrade the ASA to the latest versions of the OS (asa914-k8.bin) and ASDM (asdm-715-100.bin).
We would like to enforce a key length of 256 bits AES and 2048 RSA and the ASA should drop connection requests not meeting these standards. Is it possible to enforce this using the software mentioned?

My understanding of encryption is not the best.

Many thanks,

Alasdair Barclay
0
Alasdairb
Asked:
Alasdairb
  • 2
1 Solution
 
Henk van AchterbergCommented:
you can set SSL settings for SSL VPN/ASDM. This is not for AnyConnect though:

http://epubbud_uploads.s3.amazonaws.com/13749785/MZ39X7RW/03fig02.jpg

http://www.epubbud.com/read.php?g=MZ39X7RW&tocp=10

ciscoasa(config)#ssl trust-point TEST-CA outside
ciscoasa(config)# webvpn
ciscoasa(config-webvpn)#ssl server-version tlsv1
ciscoasa(config-webvpn)#ssl encryption aes128-sha1 aes256-sha1 3des-sha1 des-sha1
0
 
AlasdairbAuthor Commented:
Hello Henk,

thanks for the links, I did not come across these. I guess the line then would be
ciscoasa(config-webvpn)#ssl encryption aes256-sha1

and leave out the other options. It will either negotiate the aes256-sha1 or it won't connect.

I hope to have a proper read of your lined document tomorrow and will report back.

Thanks.
0
 
AlasdairbAuthor Commented:
Hello Henk,

sorry I've been away so long, many projects to pay with. It's not sorted yet, at least the enforcement, but at least the Anyconnect is working.

I'll award the points as you were the only person to help, and you gave me good reading tips I didn't find myself.

Thanks.

Alasdair
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now