3DES and AES on the same PIX

[rmgt]

I have PIX configured for 3DES encryption VPN, and I want to test with AES 128 bit...

is it possible to keep the current vpn configuration and add a new vpn group that would use AES? and how to configure the IPSEC in this case?

Thanks

 

[Antelope]

Yes, you can just add another transform set for your new encryption method. They just go down the list when trying to negotiate encryption:

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-AES esp-3des esp-aes-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-AES
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto map VPNclient 65535 ipsec-isakmp dynamic outside_dyn_map


For site-to-sites, just add another policy, it works the same way....keeps negotiating until it finds a policy that matches.

 

[rmgt]

do I need to do anything on the ISAKMP commands?

I have this currently configured

isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2