Configure Remote Access VPN Crypto Maps

Crypto maps are automatically generated for the interfaces on which IPsec-IKEv2 protocol has been enabled. You can add or remove interface groups to the selected VPN policy in Access Interface. See Configure Access Interfaces for Remote Access VPN for more information.

Procedure

Step 1

Choose Devices > VPN > Remote Access.

Step 2

From the list of available VPN policies, select the policy for which you want to modify the settings.

Step 3

Click the Advanced > Crypto Maps, and select a row in the table and click Edit to edit the Crypto map options.

Step 4

Select IKEv2 IPsec Proposals and select the transform sets to specify which authentication and encryption algorithms will be used to secure the traffic in the tunnel.

Step 5

Select Enable Reverse Route Injection to enable static routes to be automatically inserted into the routing process for those networks and hosts protected by a remote tunnel endpoint.

Step 6

Select Enable Client Services and specify the port number.

The Client Services Server provides HTTPS (SSL) access to allow the Secure Client Downloader to receive software upgrades, profiles, localization and customization files, CSD, SCEP, and other file downloads required by the client. If you select this option, specify the client services port number. If you do not enable the Client Services Server, users will not be able to download any of these files that the Secure Client might need.

Note

You can use the same port that you use for SSL VPN running on the same device. Even if you have an SSL VPN configured, you must select this option to enable file downloads over SSL for IPsec-IKEv2 clients.

Step 7

Select Enable Perfect Forward Secrecy and select the Modulus group.

Use Perfect Forward Secrecy (PFS) to generate and use a unique session key for each encrypted exchange. The unique session key protects the exchange from subsequent decryption, even if the entire exchange was recorded and the attacker has obtained the preshared or private keys used by the endpoint devices. If you select this option, also select the Diffie-Hellman key derivation algorithm to use when generating the PFS session key in the Modulus Group list.

Modulus group is the Diffie-Hellman group to use for deriving a shared secret between the two IPsec peers without transmitting it to each other. A larger modulus provides higher security but requires more processing time. The two peers must have a matching modulus group. Select the modulus group that you want to allow in the remote access VPN configuration:

  • 1—Diffie-Hellman Group 1 (768-bit modulus).

  • 2—Diffie-Hellman Group 2 (1024-bit modulus).

  • 5—Diffie-Hellman Group 5 (1536-bit modulus, considered good protection for 128-bit keys, but group 14 is better). If you are using AES encryption, use this group (or higher).

  • 14—Diffie-Hellman Group 14 (2048-bit modulus, considered good protection for 128-bit keys).

  • 19—Diffie-Hellman Group 19 (256-bit elliptical curve field size).

  • 20—Diffie-Hellman Group 20 (384-bit elliptical curve field size).

  • 21—Diffie-Hellman Group 21 (521-bit elliptical curve field size).

  • 24—Diffie-Hellman Group 24 (2048-bit modulus and 256-bit prime order subgroup).

Step 8

Specify the Lifetime Duration (seconds).

The lifetime of the security association (SA), in seconds. When the lifetime is exceeded, the SA expires and must be renegotiated between the two peers. Generally, the shorter the lifetime (up to a point), the more secure your IKE negotiations will be. However, with longer lifetimes, future IPsec security associations can be set up more quickly than with shorter lifetimes.

You can specify a value from 120 to 2147483647 seconds. The default is 28800 seconds.

Step 9

Specify the Lifetime Size (kbytes).

The volume of traffic (in kilobytes) that can pass between IPsec peers using a given security association before it expires.

You can specify a value from 10 to 2147483647 kbytes. The default is 4,608,000 kilobytes. No specification allows infinite data.

Step 10

Select the following ESPv3 Settings:

  • Validate incoming ICMP error messages—Choose whether to validate ICMP error messages received through an IPsec tunnel and destined for an interior host on the private network.

  • Enable 'Do Not Fragment' Policy—Define how the IPsec subsystem handles large packets that have the do-not-fragment (DF) bit set in the IP header, and select one of the following from the Policy list:

    • Copy—Maintains the DF bit.

    • Clear—Ignores the DF bit.

    • Set—Sets and uses the DF bit.

  • Select Enable Traffic Flow Confidentiality (TFC) Packets— Enable dummy TFC packets that mask the traffic profile which traverses the tunnel. Use the Burst, Payload Size, and Timeout parameters to generate random length packets at random intervals across the specified SA.

    Note

    Enabling traffic flow confidentiality (TFC) packets prevents the VPN tunnel from being idle. Thus the VPN idle timeout configured in the group policy does not work as expected when you enable the TFC packets. See Group Policy Advanced Options.

    • Burst—Specify a value from 1 to 16 bytes.

    • Payload Size—Specify a value from 64 to 1024 bytes.

    • Timeout—Specify a value from 10 to 60 seconds.

Step 11

Click OK.