question about 3des

[Oh]

Hello:
I have a question: I upgraded our pixs active key to 3des, if I still config like "crypto ipsec transform-set Myset esp-des esp-md5-hmac" at both peer side, does it work? If I setting one side as DES and other side as 3DES, what happens? and How about setting like "isakmp policy 20 encryption 3des"?
thanks!

 

[stakano]

Let's break this question up into three parts.

1. Can you use DES even though you've upgraded the license to 3DES? The answer is yes.

2. If I setting one side as esp-des and other side as 3DES, what happens? It won't be able to negotiate a common transformset. The key is to have a common transformset that both ends can agree on first.

3. How about setting like "isakmp policy 20 encryption 3des"? The IKE policy must be agreed on both sides as well. Policy numbers do not have to be exactly the same.

Hope this helps.