ESP Null encryption

jhosford · Jan 4, 2018, 7:05 PM

Hello,

Our security folks are insisting we use ESP with Null encryption and SHA1 hash for phase 2. They're afraid the ASA can't handle the added load to encrypt. I'm not in a position to change that and must find a way to use ESP null/SHA1.

The GUI in 2.4.2 will not allow it, and manually editing the config.xml file doesn't help either.

I need a way to set up null encryption which RFC 4301 (4.2) seems to say is an allowed configuration. 4301 says you can't do null/null, but seems to only require one or the other, which is what security is going by.

Any help is appreciated.

Jon

jimp · Jan 4, 2018, 8:52 PM

It's not supported, and probably won't be.

security folks are insisting we use ESP with Null encryption

Those are not "security folks".

If the equipment on the other end can't handle the encryption load, get better equipment.