?
Solved

Enforce encryption strength on Cisco ASA VPN

Posted on 2014-01-21
3
Medium Priority
?
2,691 Views
Last Modified: 2014-02-19
Hello

My client has an ASA 5505 firewall using the classic VPN client software. Cisco are dropping support for this client so we want to move to Anyconnect Essentials client software and we will upgrade the ASA to the latest versions of the OS (asa914-k8.bin) and ASDM (asdm-715-100.bin).
We would like to enforce a key length of 256 bits AES and 2048 RSA and the ASA should drop connection requests not meeting these standards. Is it possible to enforce this using the software mentioned?

My understanding of encryption is not the best.

Many thanks,

Alasdair Barclay
0
Comment
Question by:Alasdairb
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 12

Accepted Solution

by:
Henk van Achterberg earned 1000 total points
ID: 39798062
you can set SSL settings for SSL VPN/ASDM. This is not for AnyConnect though:

http://epubbud_uploads.s3.amazonaws.com/13749785/MZ39X7RW/03fig02.jpg

http://www.epubbud.com/read.php?g=MZ39X7RW&tocp=10

ciscoasa(config)#ssl trust-point TEST-CA outside
ciscoasa(config)# webvpn
ciscoasa(config-webvpn)#ssl server-version tlsv1
ciscoasa(config-webvpn)#ssl encryption aes128-sha1 aes256-sha1 3des-sha1 des-sha1
0
 

Author Comment

by:Alasdairb
ID: 39800497
Hello Henk,

thanks for the links, I did not come across these. I guess the line then would be
ciscoasa(config-webvpn)#ssl encryption aes256-sha1

and leave out the other options. It will either negotiate the aes256-sha1 or it won't connect.

I hope to have a proper read of your lined document tomorrow and will report back.

Thanks.
0
 

Author Closing Comment

by:Alasdairb
ID: 39871158
Hello Henk,

sorry I've been away so long, many projects to pay with. It's not sorted yet, at least the enforcement, but at least the Anyconnect is working.

I'll award the points as you were the only person to help, and you gave me good reading tips I didn't find myself.

Thanks.

Alasdair
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
Powerful tools can do wonders, but only in the right hands.  Nowhere is this more obvious than with the cloud.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses
Course of the Month8 days, 16 hours left to enroll

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question