Name

Rule name.

This name can be between 2 and 32 characters. You can use alphanumeric characters including hyphen, underscore, dot, and colon. You cannot change the name after it is saved.

Description

Brief rule description.

This description can be between 1 and 256 identifier characters. You can use alphanumeric characters including hyphens, underscore, dot, and colon.

Action

1. Select the action to take if the rule conditions are met:

   • Drop—Drops traffic or denies access.
   • Permit—Forwards traffic or allows access.
   • Reset—Resets the connection.
2. Check the Log check box to enable logging.

Protocol

EtherType

Time Range Options

To apply the rule all the time

Check the Always check box.

To apply the rule for a specific time range

To apply the rule on a periodic basis as a member of an object group

1. Uncheck the Always check box.
2. Check the Pattern check box.
3. From the Operator drop-down list, choose range (In range).
4. In the Begin fields:

   1. From the Begin drop-down list, choose the beginning day of the week or the frequency of the time range.
   2. Choose the beginning hour and minute, and AM or PM.
5. In the End fields:

   1. From the End drop-down list, choose the ending day of the week or frequency.

      Note	If you choose a frequency in the Begin drop-down list, choose the same frequency in the End drop-down list. For example, choose Weekdays from both the Begin and End drop-down lists.

   2. Choose the ending hour and minute, and AM or PM.

To apply the rule on a periodic basis, with the frequency you specify

1. Uncheck the Always check box.
2. Check the Pattern check box.
3. From the Operator drop-down list, choose range (In range).
4. In the Begin fields:

   1. From the Begin drop-down list, choose the beginning day of the week or the frequency of the time range.
   2. Choose the beginning hour and minute, and AM or PM.
5. In the End fields:

   1. From the End drop-down list, choose the ending day of the week or frequency.
   2. Choose the ending hour and minute, and AM or PM.

Source Conditions

Add Rule Condition

Click to add a rule condition.

Attribute Name

Name of the attribute.

Operator

Operator for the source condition.

Attribute Value

Value for the source condition.

Destination Conditions

Add Rule Condition

Click to add a rule condition.

Attribute Name

Name of the attribute.

Operator

Operator for the destination condition.

Attribute Value

Value for the destination condition.

Name

Relay server name.

Description

Brief description of the relay server.

Relay Server IP

IP address of the relay server.

Interface Name

Interface to use to reach the relay server.

Name

Policy name.

Description

Brief policy description.

DHCP Relay Server Assignment

You must assign at least one DHCP relay server to the policy.

General Tab

Name

Policy name.

Description

Brief policy description.

Ping Timeout (Milliseconds)

Amount of time (in milliseconds) that the DHCP server waits for a ping reply before it stops attempting to reach a pool address for client assignment.

The valid range is 10 to 10000 milliseconds.

Lease Timeout (seconds)

Amount of time (in seconds) that the DHCP server allocates an IP address to a DHCP client before reclaiming and then reallocating it to another client.

The default value is 3600 seconds.

Edge Firewall Interface Using the DHCP Client for DHCP Server Auto Configuration

To enable DHCP server automatic configuration, enter the name of the edge firewall interface that uses the DHCP client. For ASA 1000V instances, this interface is always an outside interface.

Leaving this field empty indicates that the automatic configuration feature is disabled.

Policies Tab

DNS Settings

DNS settings used by the edge firewall when configuring DHCP clients.

To add a new entry, click Add DNS Setting and add the required information.

WINS Servers

Windows Internet Naming Service (WINS) name servers that are available to DHCP clients.

To add a new WINS server, click Add WINS Server and enter the WINS server IP address.

WINS servers are listed in the order of preference, with the most preferred WINS server at the top. Select an entry in the table, and then use the arrows above the table to change server priority.

IP Address Range

Enter the following information for the DHCP address pool:

• Start IP Address—Beginning IP address of the pool.
• End IP Address—Ending IP address of the pool.
• Subnet Mask—Subnet mask to apply to the address pool.

Name

Rule name.

Description

Brief rule description.

Attack-Class Action

Information-Class Action

Protocol

Not available for configuration.

Source Conditions

Destination Conditions

Name

Rule name.

Description

Brief rule description.

Original Packet Match Conditions

Source Match Conditions

Source attributes that must be matched for the current policy to apply.

To add a new condition, click Add Rule Condition.

Available source attributes are IP Address and Network Port.

Destination Match Conditions

Destination attributes that must be matched for the current policy to apply.

To add a new condition, click Add Rule Condition.

Available destination attributes are IP Address and Network Port.

Protocol

NAT Action Table

NAT Action

From the drop-down list, choose the required translation option: Static or Dynamic.

Translated Address

For example, if you specify a source IP address match condition, you must identify a Source IP Pool object group. Similarly, a destination network port match requires a Destination Port Pool object group.

The Source IP PAT Pool option is available only if you choose dynamic translation.

Click Add Object Group to add object groups for the translation actions.

NAT Options

General Tab

Name

Policy name.

Description

Brief policy description.

Admin State

Whether the administrative status of the policy is enabled or disabled.

Rule Table

Add Rule

Click Add Rule to add a new rule to the current policy.

IPsec Settings Tab

SA Lifetime

Length of time (in days, hours, minutes, and seconds) that a security association (SA) lives before expiring.

SA Lifetime Traffic (KB)

Volume of traffic, in kilobytes, that can pass between IPsec peers using a given SA before that association expires.

Enable Perfect Forwarding Secrecy

Whether or not Perfect Forward Secrecy (PFS) is enabled.

PFS is a cryptographic characteristic associated with a derived shared secret value. With PFS, if one key is compromised, previous and subsequent keys are not compromised, because subsequent keys are not derived from previous keys.

Diffie-Hellman Group

Available if PFS is enabled.

IPsec Policies

The IPsec policy that applies to the current policy.

Select an existing IPsec policy or click Add IPsec Policy to create a new policy.

Peer Device

Peer device.

Choose an existing peer or click Add Peer Device to add a new peer.

In the Add Peer Device dialog box, enter the peer device IP address or hostname.

Other Settings Tab

Enable NAT Traversal

Whether or not IPsec peers can establish a connection through a NAT device.

Enable Reverse Route Injection

Whether or not static routes are automatically added to the routing table and then announced to neighbors on the private network.

Connection Type

Negotiation Mode

DH Group for Aggressive Mode

DH group to use when in aggressive mode: Group 1, Group 2, or Group 5.

Name

Rule name.

Description

Brief rule description.

VPN Action

Action to take based on this rule: Permit or Deny.

Protocol

Source Conditions

Source attributes that must be matched for the rule to apply.

To add a new condition, click Add Rule Condition.

Available source attributes are IP Address and Network Port.

Destination Conditions

Destination attributes that must be matched for the rule to apply.

To add a new condition, click Add Rule Condition.

Available destination attributes are IP Address and Network Port.

DH Group

Diffie-Hellman group: Group 1, Group 2, or Group 5.

Encryption

Encryption method: 3DES, AES, AES-192, AES-256, or DES.

Hash

Hash algorithm: MD5 or SHA.

Authentication

Authentication method is Preshared key.

SA Lifetime

Length of time (in days, hours, minutes, and seconds) that an SA lives before expiring.

DH Group

Diffie-Hellman group: Group 1, Group 2, Group 5, or Group 14.

Encryption

Encryption method: 3DES, AES, AES-192, AES-256, or DES.

Hash

Hash integrity algorithm: MD5, SHA, SHA256, SHA384, or SHA512.

Pseudo Random Function Hash

Pseudo-random function (PRF) has algorithm: MD5, SHA, SHA256, SHA384, or SHA512.

SA Lifetime

Length of time (in days, hours, minutes, and seconds) that an SA lives before expiring.

Name

Policy set name.

Description

Brief description of the policy set.

Admin State

Administrative state of the policy set: enabled or disabled.

Policies Area

Add Crypto Map Policy

Click to add a new policy.

Available

Policies that can be assigned to the policy set.

Use the arrows between the columns to move policies between columns.

Assigned

Policies assigned to the policy set.

Up and down arrows

Changes the priority of the selected policies.

Arrange the policies from highest to lowest priority, with the highest priority policy at the top of the list.

Enable IKE (Must check at least one)

Check the appropriate check box to specify IKE V1 or IKE V2.

Enable IPsec Pre-fragmentation

Check the check box to fragment packets before encryption. Pre-fragmentation minimizes post-fragmentation (fragmentation after encryption) and the resulting reassembly before decryption, thereby improving performance.

Do Not Fragment

Available only if the Enable IPsec Pre-fragmentation check box is checked.

Mode

Mode in which the IPsec tunnel operates.

In Tunnel mode, the IPsec tunnel encapsulates the entire IP packet.

ESP Encryption

ESP Authentication

ESP Encryption Algorithm Table

Integrity Algorithm Table

Peer Device (Unique)

Unique IP address or hostname of the peer.

IKEv1 Area

Local

Preshared key.

Confirm

Preshared key for confirmation.

Set

Whether or not the preshared key has been set and is properly configured (read-only).

IKEv2 Area

Local

Local preshared key.

Confirm

Local preshared key for confirmation.

Set

Whether or not the local preshared key has been set and is properly configured (read-only).

Remote

Remote preshared key.

Confirm

Remote preshared key for confirmation.

Set

Whether or not the remote preshared key has been set and is properly configured (read-only).

Name

Policy name.

Description

Brief policy description.

IKE Policy

Choose an existing policy from the drop-down list, or click Add IKE Policy to add a new policy.

Peer Authentication Policy

Choose an existing policy from the drop-down list, or click Add Peer Authentication Policy to add a new policy.

Enable IPsec over TCP

Whether or not IPsec traffic is allowed over TCP. If IPsec over TCP is enabled, this method takes precedence over all other connection methods.

Send Disconnect Notification

Whether or not clients are notified that sessions will be disconnected.

Allow Inbound Aggressive Mode

Whether or not inbound aggressive mode is permitted.

Wait for Termination before Rebooting

Whether or not a reboot can occur only when all active sessions have terminated voluntarily.

Threshold for Cookie Challenge (0-100 Percent)

Percentage of the maximum number of allowed Security Associations (SAs) that can be in-negotiation (open) before cookie challenges are issued for future SA negotiations.

Negotiation Threshold for Maximum SAs (0-100 Percent)

Percentage of the maximum number of allowed SAs that can be in-negotiation before additional connections are denied.

The default value is 100 percent.

IKE Identity

Key for IKE Identity

The key to use for IKE identify if the IKE identification method is Key ID.

NAT Traversal

Whether or not IPsec peers can establish a connection through a NAT device.

Keep-Alive Time for NAT Traversal

Length of time (in hours, minutes, and seconds) that a tunnel can exist with no activity before the device sends keepalive messages to the peer.

Values range from 10 to 3600 seconds, with a default of 20 seconds.

IKE Version 2 Maximum Security Associations

Whether or not the total number of IKE V2 SAs on the node can be set.

Maximum number of SA

Maximum number of SA connections allowed.

IKE V1 over TCP Port Table

1. Click Add IKE V1 Over TCP Port to add a new port.
2. In the Port field, enter the TCP port to use for IKE V1.

Anti Replay

Whether or not SA anti-replay is enabled.

Anti Replay Window Size

Window size to use to track and prevent duplication of packets. Using a larger window size allows the decryptor to track more packets.

SA Lifetime

Length of time (in days, hours, minutes, and seconds) that an SA can live before expiring.

SA Lifetime Volume (KB)

Volume of traffic, in kilobytes, that can pass between IPsec peers using a given SA before the association expires.